Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578628
MD5:	8c724813b4468960543fcbcb4635f74f
SHA1:	23693d84c1441a3edc77686c5a613f747ccff8a6
SHA256:	4cc2d946c5c43426f509193cb5bee665f59f46c795c4da045d3b5940d660e6d4
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

Overwrites Mozilla Firefox settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2260 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8C724813B4468960543FCBCB4635F74F)

skotes.exe (PID: 2676 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 8C724813B4468960543FCBCB4635F74F)

skotes.exe (PID: 4952 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8C724813B4468960543FCBCB4635F74F)

skotes.exe (PID: 4396 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8C724813B4468960543FCBCB4635F74F)

a2236cc5aa.exe (PID: 7084 cmdline: "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 2412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

a2236cc5aa.exe (PID: 5256 cmdline: "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

e565baa4b6.exe (PID: 2608 cmdline: "C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe" MD5: 25FB9C54265BBACC7A055174479F0B70)

3494904393.exe (PID: 6148 cmdline: "C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe" MD5: 04F57C6FB2B2CD8DCC4B38E4A93D4366)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5024 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6764 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

63506cf0a7384158900a9c4410789dbd.exe (PID: 2616 cmdline: "C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe" MD5: CC36E2A5A3C64941A79C31CA320E9797)

chrome.exe (PID: 8112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2244,i,11399492537237456067,12274902701966245916,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 9116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2228,i,13984323130618621561,12790505923431820552,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2268,i,11916466110525037174,8440217537469921044,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

9c439e52050a49e0875bf199b254f370.exe (PID: 4352 cmdline: "C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe" MD5: 971B0519B1C0461DB6700610E5E9CA8E)

128703c003.exe (PID: 2584 cmdline: "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe" MD5: 3647AF905F92B479113300608444F101)

8a13e339a3.exe (PID: 3184 cmdline: "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe" MD5: 2854309DFD78A64E325E67004B94ADDF)

chrome.exe (PID: 3948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2108,i,8456486069817355234,11844497876439490650,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 4672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

7ccdd68f3b.exe (PID: 3848 cmdline: "C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe" MD5: 134E8ED7546996583F248F49C87D99A2)

taskkill.exe (PID: 6824 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4304 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7000 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5940 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1120 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3716 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

2fc1eb1411.exe (PID: 7848 cmdline: "C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe" MD5: 27D1C23073BBF3BE2092A18AB4CF9818)

ebfedd813b.exe (PID: 7380 cmdline: "C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

svchost.exe (PID: 348 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

128703c003.exe (PID: 4088 cmdline: "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe" MD5: 3647AF905F92B479113300608444F101)

128703c003.exe (PID: 5888 cmdline: "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe" MD5: 3647AF905F92B479113300608444F101)

firefox.exe (PID: 2072 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2792 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7784 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3116d80-26e5-4678-b47c-6e372794e0eb} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2800d16fd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8716 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -parentBuildID 20230927232528 -prefsHandle 4300 -prefMapHandle 4304 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {822619a6-5657-47d3-80bf-2521004ff1f0} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 28020772b10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8a13e339a3.exe (PID: 8356 cmdline: "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe" MD5: 2854309DFD78A64E325E67004B94ADDF)

7ccdd68f3b.exe (PID: 9108 cmdline: "C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe" MD5: 134E8ED7546996583F248F49C87D99A2)

taskkill.exe (PID: 4140 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

2fc1eb1411.exe (PID: 8280 cmdline: "C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe" MD5: 27D1C23073BBF3BE2092A18AB4CF9818)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["energyaffai.lat", "discokeyus.lat", "necklacebudi.lat", "sustainskelet.lat", "crosshuaht.lat", "aspecteirs.lat", "rapeflowwj.lat", "pancakedipyps.click", "grannyejh.lat"], "Build id": "nheapcorruption--"}

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000030.00000003.3288737853.0000000004830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.3258078775.000000000169B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2200230498.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.3006312115.0000000001288000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.3275631067.000000000169B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2630147663.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.3258078775.00000000016F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3500289993.0000000001354000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.3275631067.00000000016F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.3335757490.000000000169B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3503373239.0000000001355000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2202358687.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.3501962670.0000000001354000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.3086871686.0000000005210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.2160698202.0000000004780000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.3334478529.000000000169B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: a2236cc5aa.exe PID: 5256	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: a2236cc5aa.exe PID: 5256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: a2236cc5aa.exe PID: 5256	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e565baa4b6.exe PID: 2608	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e565baa4b6.exe PID: 2608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e565baa4b6.exe PID: 2608	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3494904393.exe PID: 6148	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 3494904393.exe PID: 6148	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8a13e339a3.exe PID: 3184	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8a13e339a3.exe PID: 3184	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 128703c003.exe PID: 4088	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 128703c003.exe PID: 4088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 128703c003.exe PID: 4088	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7ccdd68f3b.exe PID: 3848	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author
19.0.63506cf0a7384158900a9c4410789dbd.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.skotes.exe.190000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.e10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.190000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4396, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\128703c003.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe, ParentProcessId: 6148, ParentProcessName: 3494904393.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl", ProcessId: 5024, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe, ParentProcessId: 3184, ParentProcessName: 8a13e339a3.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 3948, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4396, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\128703c003.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe, ParentProcessId: 6148, ParentProcessName: 3494904393.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl", ProcessId: 5024, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 348, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}
Source: a2236cc5aa.exe.7084.7.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["energyaffai.lat", "discokeyus.lat", "necklacebudi.lat", "sustainskelet.lat", "crosshuaht.lat", "aspecteirs.lat", "rapeflowwj.lat", "pancakedipyps.click", "grannyejh.lat"], "Build id": "nheapcorruption--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[5].exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\1017994001\98679d2b4b.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000000.3044420282.0000018167332000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000000.3044420282.0000018167332000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DC36A9 FindFirstFileExW,		7_2_00DC36A9
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DC375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,		7_2_00DC375A

Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 30MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 192MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199809363512
Source: Malware configuration extractor	IPs: 185.215.113.43

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe, type: DROPPED

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 116.203.12.114 116.203.12.114
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E1E0C0 recv,recv,recv,recv,

0_2_00E1E0C0

Source: 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/H
Source: 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/j
Source: 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/l
Source: 128703c003.exe, 00000017.00000003.3659903833.0000000001711000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exevh
Source: 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001381000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001381000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/7
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: 8a13e339a3.exe, 00000015.00000003.3429013238.0000000001394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/h
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 128703c003.exe, 00000012.00000003.3011066639.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000003.3011534814.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: e565baa4b6.exe, 0000000A.00000003.3253053792.000000000085F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2913135607.0000000002D49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2972792900.0000000007FD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreAppList.Light.png
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreLogo.Light.png
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/app.Light.ico
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181003E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://e12564.dspb.akamaiedge.net
Source: svchost.exe, 00000016.00000003.3061403026.0000019246380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/StoreAppList.Light.png
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/StoreLogo.Light.png
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/app.Light.ico
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/app.light.ico
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/storeapplist.light.png
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/storelogo.light.png
Source: 3494904393.exe, 0000000B.00000002.3054106984.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3054106984.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: 3494904393.exe, 0000000B.00000002.3054106984.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3054106984.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: powershell.exe, 0000000D.00000002.2917207950.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/StoreInstaller.Models
Source: powershell.exe, 0000000D.00000002.2914223441.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 3494904393.exe, 0000000B.00000002.3054106984.0000000002831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2914223441.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004541000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181003C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.2914223441.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3081412103.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3068983043.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000000D.00000002.2914223441.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: a2236cc5aa.exe, 00000009.00000003.2976264747.0000000003848000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: a2236cc5aa.exe, 00000009.00000003.2976264747.0000000003848000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/B
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/CA
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/MA
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/O
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/W
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/c
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/g
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/gA
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/hA
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/w
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/yB
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/z
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frostman.shop/~A
Source: svchost.exe, 00000016.00000003.3061403026.00000192463F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000016.00000003.3061403026.0000019246380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: 3494904393.exe, 0000000B.00000002.3054106984.00000000028CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp, 3494904393.exe, 0000000B.00000002.3054106984.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3054106984.0000000002842000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: 3494904393.exe, 0000000B.00000002.3054106984.0000000002859000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp, 3494904393.exe, 0000000B.00000002.3054106984.0000000002842000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe
Source: 128703c003.exe, 00000017.00000003.3168584611.000000000169B000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3371714370.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: 128703c003.exe, 00000012.00000003.3011604086.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000002.3012509947.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/2H
Source: 128703c003.exe, 00000012.00000003.3011604086.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000002.3012509947.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/4
Source: 128703c003.exe, 00000017.00000003.3168584611.000000000169B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/W
Source: 128703c003.exe, 00000017.00000003.3412151122.0000000001703000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3258078775.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3334200098.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3368106621.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3275631067.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3337300081.0000000001702000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3371714370.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/X
Source: 128703c003.exe, 00000017.00000003.3244507163.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3312048680.0000000005E73000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3168584611.000000000169B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: 128703c003.exe, 00000017.00000003.3409861563.0000000005E73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiM
Source: 128703c003.exe, 00000012.00000002.3012272539.000000000099E000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3168584611.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apit
Source: 128703c003.exe, 00000017.00000003.3168584611.000000000169B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiup
Source: 128703c003.exe, 00000017.00000003.3168584611.000000000169B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/h
Source: 128703c003.exe, 00000017.00000003.3168584611.0000000001682000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3212635855.0000000005E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/p
Source: 128703c003.exe, 00000012.00000003.3011604086.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000002.3012509947.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/u
Source: 128703c003.exe, 00000012.00000003.3011066639.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000002.3012509947.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3168584611.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3411535571.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3368738714.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3334478529.0000000001679000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: 128703c003.exe, 00000017.00000003.3368738714.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3334478529.0000000001679000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/apical
Source: 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 0000000D.00000002.2917207950.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: a2236cc5aa.exe, a2236cc5aa.exe, 00000009.00000002.3133800466.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2972854469.0000000003834000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3092499477.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3034726949.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029644708.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122847906.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029780575.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3137538281.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/#
Source: a2236cc5aa.exe, 00000009.00000003.3006312115.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/H
Source: a2236cc5aa.exe, a2236cc5aa.exe, 00000009.00000003.3119803218.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3092499477.0000000001284000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000122B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029437490.0000000001283000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122847906.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.0000000001284000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122658789.000000000122D000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3087755714.000000000383D000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3137538281.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.0000000001284000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3134231707.000000000122E000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3006552725.0000000001283000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3116794521.000000000383D000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3047195115.000000000382F000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3047775117.0000000003832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiH
Source: a2236cc5aa.exe, 00000009.00000003.3119803218.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122847906.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3137538281.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiT
Source: a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apis
Source: a2236cc5aa.exe, 00000009.00000003.3092499477.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: a2236cc5aa.exe, 00000009.00000003.2972184355.0000000003834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/x
Source: a2236cc5aa.exe, 00000009.00000003.3007554160.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/apicrosoft
Source: a2236cc5aa.exe, 00000009.00000002.3133800466.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3092499477.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029437490.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/apiefault-release/key4.dbPK
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.comD
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296B000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 3494904393.exe, 0000000B.00000002.3054106984.000000000296B000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://t.me/k04ael
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: e565baa4b6.exe, 0000000A.00000003.3132201109.00000000053FC000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133060846.0000000005405000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3137766063.0000000005406000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3316209595.0000000005407000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3106309298.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3103245205.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3316055734.0000000005401000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133607214.0000000005406000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3108132250.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3132201109.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3132555502.0000000005402000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3106075883.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3255326461.0000000005406000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3132410630.00000000053FC000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3190290068.0000000005405000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3162109459.0000000005402000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/
Source: e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/;.
Source: e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/=lg7
Source: e565baa4b6.exe, 0000000A.00000003.3254207262.0000000000815000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3190222323.0000000000872000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3288044439.000000000087B000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: e565baa4b6.exe, 0000000A.00000002.3285986121.0000000000815000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3254207262.0000000000815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api&
Source: e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apiA
Source: e565baa4b6.exe, 0000000A.00000003.3167500325.0000000000879000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3166630569.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apiZz
Source: e565baa4b6.exe, 0000000A.00000003.3190256210.0000000000865000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/eml7=
Source: e565baa4b6.exe, 0000000A.00000003.3255326461.0000000005406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/r
Source: e565baa4b6.exe, 0000000A.00000003.3162109459.0000000005402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/u
Source: e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/us
Source: e565baa4b6.exe, 0000000A.00000003.3254207262.0000000000809000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3285986121.000000000080C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3068983043.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: a2236cc5aa.exe, 00000009.00000003.2976264747.0000000003848000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: a2236cc5aa.exe, 00000009.00000003.2975183013.0000000003AD7000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3138324559.0000000005694000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: a2236cc5aa.exe, 00000009.00000003.2975183013.0000000003AD7000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3138324559.0000000005694000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: a2236cc5aa.exe, 00000009.00000003.2975183013.0000000003AD7000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3138324559.0000000005694000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000029.00000002.3223968923.0000018C06C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: e565baa4b6.exe.6.dr	Static PE information: section name:
Source: e565baa4b6.exe.6.dr	Static PE information: section name: .idata
Source: e565baa4b6.exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: 1e467b8b46.exe.6.dr	Static PE information: section name:
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: .idata
Source: 1e467b8b46.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: 128703c003.exe.6.dr	Static PE information: section name:
Source: 128703c003.exe.6.dr	Static PE information: section name: .idata
Source: 128703c003.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: 8a13e339a3.exe.6.dr	Static PE information: section name:
Source: 8a13e339a3.exe.6.dr	Static PE information: section name: .idata
Source: random[4].exe.6.dr	Static PE information: section name:
Source: random[4].exe.6.dr	Static PE information: section name: .idata
Source: random[4].exe.6.dr	Static PE information: section name:
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name:
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: .idata
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name: .idata
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name:
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name: .idata
Source: random[5].exe.6.dr	Static PE information: section name:
Source: random[5].exe.6.dr	Static PE information: section name: .idata
Source: random[5].exe.6.dr	Static PE information: section name:
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name:
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name: .idata
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E578BB	0_2_00E578BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E58860	0_2_00E58860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57049	0_2_00E57049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E531A8	0_2_00E531A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E14B30	0_2_00E14B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E14DE0	0_2_00E14DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E52D10	0_2_00E52D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E5779B	0_2_00E5779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E47F36	0_2_00E47F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001D7049	2_2_001D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001D8860	2_2_001D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001D78BB	2_2_001D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001D31A8	2_2_001D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00194B30	2_2_00194B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001D2D10	2_2_001D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00194DE0	2_2_00194DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001C7F36	2_2_001C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001D779B	2_2_001D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001D7049	3_2_001D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001D8860	3_2_001D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001D78BB	3_2_001D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001D31A8	3_2_001D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00194B30	3_2_00194B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001D2D10	3_2_001D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00194DE0	3_2_00194DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001C7F36	3_2_001C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001D779B	3_2_001D779B
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB1000	7_2_00DB1000
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB4C8C	7_2_00DB4C8C
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DC6F3A	7_2_00DC6F3A
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0129DB63	9_3_0129DB63
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0128D14F	9_3_0128D14F
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0128D14F	9_3_0128D14F
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0128D14F	9_3_0128D14F
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0128D14F	9_3_0128D14F
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_038319BA	9_3_038319BA
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012B2060	9_3_012B2060
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0128D14F	9_3_0128D14F
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0128D14F	9_3_0128D14F

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00E280C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001ADF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001A80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: String function: 00DB5190 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983129683242506
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983129683242506
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: random[1].exe.6.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: e565baa4b6.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: e565baa4b6.exe.6.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: random[1].exe1.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe1.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: a2236cc5aa.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: a2236cc5aa.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[3].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[3].exe.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: 1e467b8b46.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 1e467b8b46.exe.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: random[1].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: random[1].exe2.6.dr	Static PE information: Section: ijtgtnqw ZLIB complexity 0.9945006846635368
Source: 128703c003.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: 128703c003.exe.6.dr	Static PE information: Section: ijtgtnqw ZLIB complexity 0.9945006846635368
Source: random[4].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9951820514298892
Source: random[4].exe.6.dr	Static PE information: Section: xmsxfkky ZLIB complexity 0.9925249169435216
Source: 5dfec4fe99.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9951820514298892
Source: 5dfec4fe99.exe.6.dr	Static PE information: Section: xmsxfkky ZLIB complexity 0.9925249169435216
Source: random[5].exe.6.dr	Static PE information: Section: biyvevdc ZLIB complexity 0.9944533911839863
Source: 4c7aea0d0a.exe.6.dr	Static PE information: Section: biyvevdc ZLIB complexity 0.9944533911839863

Source: 5dfec4fe99.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[4].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: 3494904393.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3494904393.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[3].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[3].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7bbff7a3a2.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7bbff7a3a2.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[1].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[1].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@149/127@0/31

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\SyncRootManager
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2412:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9MSZ40SLW145

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: a2236cc5aa.exe, 00000009.00000003.2811868502.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2948173459.00000000037BB000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811417329.00000000037D4000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3008900293.000000000537B000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3107194398.0000000005380000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3008201130.0000000005396000.00000004.00000800.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3593209600.0000000005CAC000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3425134928.0000000005CB8000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3173892198.0000000005E06000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3175373618.0000000005DEA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Process created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe "C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe "C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe "C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe "C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe "C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe"
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2108,i,8456486069817355234,11844497876439490650,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3116d80-26e5-4678-b47c-6e372794e0eb} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2800d16fd10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe "C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2244,i,11399492537237456067,12274902701966245916,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -parentBuildID 20230927232528 -prefsHandle 4300 -prefMapHandle 4304 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {822619a6-5657-47d3-80bf-2521004ff1f0} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 28020772b10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe "C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2228,i,13984323130618621561,12790505923431820552,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe "C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe "C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2268,i,11916466110525037174,8440217537469921044,262144 /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe "C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe "C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe "C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe "C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe "C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Process created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe "C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe "C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: unknown unknown
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: unknown unknown
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: unknown unknown
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2108,i,8456486069817355234,11844497876439490650,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3116d80-26e5-4678-b47c-6e372794e0eb} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2800d16fd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -parentBuildID 20230927232528 -prefsHandle 4300 -prefMapHandle 4304 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {822619a6-5657-47d3-80bf-2521004ff1f0} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 28020772b10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2268,i,11916466110525037174,8440217537469921044,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2244,i,11399492537237456067,12274902701966245916,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2228,i,13984323130618621561,12790505923431820552,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2268,i,11916466110525037174,8440217537469921044,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: apphelp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: sspicli.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: wininet.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: rstrtmgr.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: ncrypt.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: ntasn1.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: dbghelp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: iertutil.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: windows.storage.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: wldp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: profapi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: kernel.appcore.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: winhttp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: mswsock.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: iphlpapi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: winnsi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: urlmon.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: srvcli.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: netutils.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: dnsapi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: rasadhlp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: fwpuclnt.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: schannel.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: mskeyprotect.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: msasn1.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: dpapi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: cryptsp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: rsaenh.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: cryptbase.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: gpapi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: ncryptsslp.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: ntmarta.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: uxtheme.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: windowscodecs.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: propsys.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: ntshrui.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: cscapi.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: linkinfo.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: edputil.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: wintypes.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: appresolver.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: bcp47langs.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: slc.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: userenv.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: sppc.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: pcacli.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: mpr.dll
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Section loaded: sfc_os.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mscoree.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: kernel.appcore.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: version.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: uxtheme.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: cryptsp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: rsaenh.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: cryptbase.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dwrite.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.storage.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: wldp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: profapi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.applicationmodel.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: twinapi.appcore.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: wintypes.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.globalization.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: bcp47langs.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: bcp47mrm.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dwmapi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: d3d9.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: d3d10warp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: urlmon.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: iertutil.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: srvcli.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: netutils.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windowscodecs.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: msasn1.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: msisip.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: wshext.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: appxsip.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: opcservices.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: esdsip.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ncrypt.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ntasn1.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ncrypt.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ntasn1.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ncryptprov.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: wtsapi32.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: winsta.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: powrprof.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: umpdc.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.web.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dataexchange.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: d3d11.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dcomp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dxgi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: resourcepolicyclient.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dxcore.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: textshaping.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: winmm.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: textinputframework.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: coreuicomponents.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: coremessaging.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ntmarta.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: coremessaging.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: msctfui.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: uiautomationcore.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: propsys.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: d3dcompiler_47.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: wininet.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: sspicli.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: rasapi32.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: rasman.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: rtutils.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mswsock.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: winhttp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: iphlpapi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dhcpcsvc6.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dhcpcsvc.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: winnsi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: dnsapi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: rasadhlp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: fwpuclnt.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: secur32.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: schannel.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mskeyprotect.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ncryptsslp.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: gpapi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: installservice.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: userenv.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mpr.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: slc.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: sppc.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: ieframe.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: netapi32.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: wkscli.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: edputil.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mlang.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: policymanager.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: msvcp110_win.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: twinui.appcore.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: execmodelproxy.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mscms.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: coloradapterclient.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windowscodecsext.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: mrmcorer.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: appxdeploymentclient.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windows.ui.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: windowmanagementapi.dll
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Section loaded: vcruntime140.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 3023360 > 1048576

Source: file.exe

Static PE information: Raw size of kfjqblss is bigger than: 0x100000 < 0x2b0800

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000000.3044420282.0000018167332000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000000.3044420282.0000018167332000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W;kfjqblss:EW;vivpivkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kfjqblss:EW;vivpivkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;kfjqblss:EW;vivpivkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kfjqblss:EW;vivpivkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;kfjqblss:EW;vivpivkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kfjqblss:EW;vivpivkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Unpacked PE file: 10.2.e565baa4b6.exe.dc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Unpacked PE file: 18.2.128703c003.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ijtgtnqw:EW;jumutqrp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ijtgtnqw:EW;jumutqrp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Unpacked PE file: 45.2.2fc1eb1411.exe.9b0000.0.unpack :EW;.rsrc:W;.idata :W;ehjhpitf:EW;ijjaccto:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Unpacked PE file: 54.2.2fc1eb1411.exe.9b0000.0.unpack :EW;.rsrc:W;.idata :W;ehjhpitf:EW;ijjaccto:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: random[1].exe0.6.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 1e467b8b46.exe.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: 101d940598.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: 8a13e339a3.exe.6.dr	Static PE information: real checksum: 0x2c79bb should be: 0x2c5eda
Source: random[3].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1bef30 should be: 0x1bb53a
Source: 5dfec4fe99.exe.6.dr	Static PE information: real checksum: 0x1e67b5 should be: 0x1ea0a4
Source: 2fc1eb1411.exe.6.dr	Static PE information: real checksum: 0x2b9e5c should be: 0x2affdc
Source: 4c7aea0d0a.exe.6.dr	Static PE information: real checksum: 0x4481f0 should be: 0x44f698
Source: 7bbff7a3a2.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: random[3].exe.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2e35a5 should be: 0x2ee0bf
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 128703c003.exe.6.dr	Static PE information: real checksum: 0x1bef30 should be: 0x1bb53a
Source: 3494904393.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: e565baa4b6.exe.6.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: a2236cc5aa.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: random[3].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: random[5].exe.6.dr	Static PE information: real checksum: 0x4481f0 should be: 0x44f698
Source: random[4].exe.6.dr	Static PE information: real checksum: 0x1e67b5 should be: 0x1ea0a4
Source: random[2].exe1.6.dr	Static PE information: real checksum: 0x2b9e5c should be: 0x2affdc
Source: file.exe	Static PE information: real checksum: 0x2e35a5 should be: 0x2ee0bf
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2c79bb should be: 0x2c5eda

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: kfjqblss
Source: file.exe	Static PE information: section name: vivpivkj
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: kfjqblss
Source: skotes.exe.0.dr	Static PE information: section name: vivpivkj
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: uzxdwyvi
Source: random[1].exe.6.dr	Static PE information: section name: efzdldig
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: e565baa4b6.exe.6.dr	Static PE information: section name:
Source: e565baa4b6.exe.6.dr	Static PE information: section name: .idata
Source: e565baa4b6.exe.6.dr	Static PE information: section name:
Source: e565baa4b6.exe.6.dr	Static PE information: section name: uzxdwyvi
Source: e565baa4b6.exe.6.dr	Static PE information: section name: efzdldig
Source: e565baa4b6.exe.6.dr	Static PE information: section name: .taggant
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: xnuzvlhe
Source: random[3].exe.6.dr	Static PE information: section name: tzuttanx
Source: random[3].exe.6.dr	Static PE information: section name: .taggant
Source: 1e467b8b46.exe.6.dr	Static PE information: section name:
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: .idata
Source: 1e467b8b46.exe.6.dr	Static PE information: section name:
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: xnuzvlhe
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: tzuttanx
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: ijtgtnqw
Source: random[1].exe2.6.dr	Static PE information: section name: jumutqrp
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 128703c003.exe.6.dr	Static PE information: section name:
Source: 128703c003.exe.6.dr	Static PE information: section name: .idata
Source: 128703c003.exe.6.dr	Static PE information: section name:
Source: 128703c003.exe.6.dr	Static PE information: section name: ijtgtnqw
Source: 128703c003.exe.6.dr	Static PE information: section name: jumutqrp
Source: 128703c003.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: uqvrrapw
Source: random[2].exe.6.dr	Static PE information: section name: blfuhhpc
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 8a13e339a3.exe.6.dr	Static PE information: section name:
Source: 8a13e339a3.exe.6.dr	Static PE information: section name: .idata
Source: 8a13e339a3.exe.6.dr	Static PE information: section name: uqvrrapw
Source: 8a13e339a3.exe.6.dr	Static PE information: section name: blfuhhpc
Source: 8a13e339a3.exe.6.dr	Static PE information: section name: .taggant
Source: random[4].exe.6.dr	Static PE information: section name:
Source: random[4].exe.6.dr	Static PE information: section name: .idata
Source: random[4].exe.6.dr	Static PE information: section name:
Source: random[4].exe.6.dr	Static PE information: section name: xmsxfkky
Source: random[4].exe.6.dr	Static PE information: section name: uydpyjdy
Source: random[4].exe.6.dr	Static PE information: section name: .taggant
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name:
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: .idata
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name:
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: xmsxfkky
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: uydpyjdy
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe1.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name: .idata
Source: random[2].exe1.6.dr	Static PE information: section name: ehjhpitf
Source: random[2].exe1.6.dr	Static PE information: section name: ijjaccto
Source: random[2].exe1.6.dr	Static PE information: section name: .taggant
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name:
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name: .idata
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name: ehjhpitf
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name: ijjaccto
Source: 2fc1eb1411.exe.6.dr	Static PE information: section name: .taggant
Source: random[5].exe.6.dr	Static PE information: section name:
Source: random[5].exe.6.dr	Static PE information: section name: .idata
Source: random[5].exe.6.dr	Static PE information: section name:
Source: random[5].exe.6.dr	Static PE information: section name: biyvevdc
Source: random[5].exe.6.dr	Static PE information: section name: aogmlwgx
Source: random[5].exe.6.dr	Static PE information: section name: .taggant
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name:
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name: .idata
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name:
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name: biyvevdc
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name: aogmlwgx
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E2D91C push ecx; ret	0_2_00E2D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E21359 push es; ret	0_2_00E2135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001AD91C push ecx; ret	2_2_001AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001AD91C push ecx; ret	3_2_001AD92F
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB534A push ecx; ret	7_2_00DB535D
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012949B5 push eax; ret	9_3_01294AEB
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012949B5 push eax; ret	9_3_01294AEB
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01292336 push edi; retf	9_3_0129233A
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01292336 push edi; retf	9_3_0129233A
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01292B8C push 00000046h; retf	9_3_01292B95
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01292B8C push 00000046h; retf	9_3_01292B95
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01290B60 push eax; ret	9_3_01290BA1
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01290B49 push eax; ret	9_3_01290BA1
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122C362 pushad ; ret	9_3_0122C365
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CB62 pushad ; retf	9_3_0122CB65
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CF62 pushad ; iretd	9_3_0122CF65
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CB66 push 680122CBh; retf	9_3_0122CB6D
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122C366 push 680122C3h; ret	9_3_0122C36D
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CF66 push 680122CFh; iretd	9_3_0122CF6D
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01235E68 push 00000046h; retf	9_3_01235E71
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_01235E68 push 00000046h; retf	9_3_01235E71
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CF4E push eax; iretd	9_3_0122CF51
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CB4E push eax; retf	9_3_0122CB51
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122C34E push eax; ret	9_3_0122C351
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CB52 push eax; retf	9_3_0122CB55
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122C352 push eax; ret	9_3_0122C355
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CF52 push eax; iretd	9_3_0122CF55
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CB5E pushad ; retf	9_3_0122CB61
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122C35E pushad ; ret	9_3_0122C361
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_0122CF5E pushad ; iretd	9_3_0122CF61
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 9_3_012348D1 push 00000046h; retf	9_3_012348DA

Source: file.exe	Static PE information: section name: entropy: 7.985538983935103
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.985538983935103
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.974324170155358
Source: random[1].exe.6.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: e565baa4b6.exe.6.dr	Static PE information: section name: entropy: 7.974324170155358
Source: e565baa4b6.exe.6.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: random[3].exe.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[3].exe.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: 1e467b8b46.exe.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.983747269135125
Source: random[1].exe2.6.dr	Static PE information: section name: ijtgtnqw entropy: 7.953803089341506
Source: 128703c003.exe.6.dr	Static PE information: section name: entropy: 7.983747269135125
Source: 128703c003.exe.6.dr	Static PE information: section name: ijtgtnqw entropy: 7.953803089341506
Source: random[4].exe.6.dr	Static PE information: section name: entropy: 7.979153316979525
Source: random[4].exe.6.dr	Static PE information: section name: xmsxfkky entropy: 7.952028696274607
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: entropy: 7.979153316979525
Source: 5dfec4fe99.exe.6.dr	Static PE information: section name: xmsxfkky entropy: 7.952028696274607
Source: random[5].exe.6.dr	Static PE information: section name: biyvevdc entropy: 7.956080074817993
Source: 4c7aea0d0a.exe.6.dr	Static PE information: section name: biyvevdc entropy: 7.956080074817993

Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017997001\4e48e9ad99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017989001\4c7aea0d0a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File created: C:\Users\user\AppData\Local\Temp\RIZ8QT1S0BQ20WD7KBBS21.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017996001\9c5dc2c478.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017986001\5dfec4fe99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	File created: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017998001\ab2f510d23.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017995001\8d966c471d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017991001\617d9fb7ad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017983001\f71e300ff9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017999001\daaacc90a2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017994001\98679d2b4b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File created: C:\Users\user\AppData\Local\Temp\WHQUF4KURLOTATA7WCHH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File created: C:\Users\user\AppData\Local\Temp\TYUE4E8K2GIAZ6KSY1ZAXK0WL48NIVF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	File created: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File created: C:\Users\user\AppData\Local\Temp\DFAWHTB6ZKNPCDBIS7.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4e48e9ad99.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2fc1eb1411.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 128703c003.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a13e339a3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d966c471d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c5dc2c478.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7ccdd68f3b.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 128703c003.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 128703c003.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a13e339a3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a13e339a3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7ccdd68f3b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7ccdd68f3b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2fc1eb1411.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2fc1eb1411.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d966c471d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d966c471d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c5dc2c478.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c5dc2c478.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4e48e9ad99.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4e48e9ad99.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-9724

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043744464.000000000041F000.00000002.00000001.01000000.00000010.sdmp

Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF78C second address: FFF792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF792 second address: FFF79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94C2 second address: FE94D5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7085255316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94D5 second address: FE94DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94DB second address: FE94DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94DF second address: FE94E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94E3 second address: FE9510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255325h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007F708525531Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFECE2 second address: FFECE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFECE8 second address: FFED0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jns 00007F7085255316h 0x0000000c pop edx 0x0000000d jmp 00007F708525531Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFED0F second address: FFED15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFED15 second address: FFED2F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F7085255324h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF035 second address: FFF03B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002AE7 second address: 1002B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F708525531Dh 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jng 00007F7085255324h 0x00000016 pushad 0x00000017 jnp 00007F7085255316h 0x0000001d jne 00007F7085255316h 0x00000023 popad 0x00000024 mov eax, dword ptr [esp+04h] 0x00000028 pushad 0x00000029 jmp 00007F7085255321h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 pop eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002C02 second address: 1002C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002C0C second address: 1002C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 2EB13027h 0x0000000d mov ecx, dword ptr [ebp+122D2C8Eh] 0x00000013 push 00000003h 0x00000015 or ecx, 673BD2AAh 0x0000001b push 00000000h 0x0000001d mov ch, bh 0x0000001f push 00000003h 0x00000021 mov ecx, dword ptr [ebp+122D1C8Eh] 0x00000027 call 00007F7085255319h 0x0000002c jmp 00007F7085255326h 0x00000031 push eax 0x00000032 push edi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002C58 second address: 1002C7D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7084E7CE44h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002C7D second address: 1002C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002C83 second address: 1002C9B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F7084E7CE38h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002C9B second address: 1002CA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002CA2 second address: 1002CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jp 00007F7084E7CE3Ch 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002D4B second address: 1002D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002ECA second address: 1002ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002ECE second address: 1002EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007F708525531Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7085255326h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002EFB second address: 1002FCA instructions: 0x00000000 rdtsc 0x00000002 js 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c and edx, dword ptr [ebp+122D2C8Eh] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F7084E7CE38h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push A1483D9Bh 0x00000033 push esi 0x00000034 jmp 00007F7084E7CE49h 0x00000039 pop esi 0x0000003a add dword ptr [esp], 5EB7C2E5h 0x00000041 jmp 00007F7084E7CE3Dh 0x00000046 mov ecx, dword ptr [ebp+122D2ED2h] 0x0000004c push 00000003h 0x0000004e pushad 0x0000004f sub dword ptr [ebp+122D3509h], edx 0x00000055 mov ecx, dword ptr [ebp+122D2CD2h] 0x0000005b popad 0x0000005c call 00007F7084E7CE3Ah 0x00000061 xor dword ptr [ebp+122D3518h], esi 0x00000067 pop edi 0x00000068 push 00000000h 0x0000006a jmp 00007F7084E7CE3Eh 0x0000006f push 00000003h 0x00000071 mov ecx, dword ptr [ebp+122D1C3Ch] 0x00000077 stc 0x00000078 call 00007F7084E7CE39h 0x0000007d pushad 0x0000007e jmp 00007F7084E7CE43h 0x00000083 push eax 0x00000084 push edx 0x00000085 jmp 00007F7084E7CE3Bh 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002FCA second address: 1002FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002FCE second address: 1002FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F7084E7CE44h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002FF3 second address: 1002FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002FF8 second address: 1003068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnl 00007F7084E7CE4Eh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 ja 00007F7084E7CE3Ah 0x0000001b push esi 0x0000001c pushad 0x0000001d popad 0x0000001e pop esi 0x0000001f pop eax 0x00000020 add dword ptr [ebp+122D3A49h], eax 0x00000026 lea ebx, dword ptr [ebp+12457A76h] 0x0000002c mov dword ptr [ebp+122D366Bh], ebx 0x00000032 jnc 00007F7084E7CE38h 0x00000038 mov dl, 0Eh 0x0000003a push eax 0x0000003b js 00007F7084E7CE49h 0x00000041 pushad 0x00000042 jmp 00007F7084E7CE3Bh 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022BD5 second address: 1022BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F7085255326h 0x0000000b jmp 00007F7085255320h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020A34 second address: 1020A3E instructions: 0x00000000 rdtsc 0x00000002 je 00007F7084E7CE36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020C0B second address: 1020C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020C0F second address: 1020C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020E9A second address: 1020E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020E9F second address: 1020EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102102B second address: 1021031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021031 second address: 1021036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10211CF second address: 10211D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10211D3 second address: 10211D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102149B second address: 10214B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255321h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10214B6 second address: 10214C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7084E7CE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10214C0 second address: 10214C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021634 second address: 1021648 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021A7C second address: 1021A9C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7085255326h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021BDB second address: 1021C16 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F7084E7CE3Bh 0x00000012 pop ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jmp 00007F7084E7CE47h 0x0000001a pushad 0x0000001b jng 00007F7084E7CE36h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022365 second address: 1022369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022369 second address: 102237D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7084E7CE3Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A7A second address: 1022A84 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7085255316h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024FA4 second address: 1024FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024FA8 second address: 1024FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F7085255316h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024FBA second address: 1024FC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025FFA second address: 102602E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [eax] 0x00000006 jno 00007F708525532Dh 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F708525531Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E03B second address: 102E03F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E73F second address: 102E743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E743 second address: 102E74D instructions: 0x00000000 rdtsc 0x00000002 je 00007F7084E7CE36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E74D second address: 102E75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 je 00007F7085255324h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E75D second address: 102E763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E8AC second address: 102E8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E8C8 second address: 102E8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7084E7CE36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E8D3 second address: 102E8D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E8D9 second address: 102E8FD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7084E7CE36h 0x00000008 jmp 00007F7084E7CE47h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102FC31 second address: 102FC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102FDE9 second address: 102FDF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F7084E7CE36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102FF25 second address: 102FF2F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F708525531Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030104 second address: 1030108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030108 second address: 103010E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10303D3 second address: 10303DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103091E second address: 103093D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030D9C second address: 1030DA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030DA2 second address: 1030DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7085255316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030DAC second address: 1030DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030DB0 second address: 1030DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030DBF second address: 1030DF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F7084E7CE38h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 add edi, 22EC1BF0h 0x00000029 push eax 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d push esi 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030DF6 second address: 1030DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031DD0 second address: 1031DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031DE8 second address: 1031DFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F708525531Eh 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E63 second address: 1032E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7084E7CE36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E72 second address: 1032E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E76 second address: 1032E84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10338D0 second address: 1033926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F7085255318h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D260Eh], eax 0x0000002d push 00000000h 0x0000002f or dword ptr [ebp+122D25DCh], eax 0x00000035 push 00000000h 0x00000037 jne 00007F7085255316h 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 jmp 00007F7085255321h 0x00000046 pop esi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033674 second address: 103368D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7084E7CE44h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034DCC second address: 1034DD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F7085255316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034B56 second address: 1034B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F7084E7CE36h 0x00000009 jmp 00007F7084E7CE3Fh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 js 00007F7084E7CE40h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034DD6 second address: 1034E10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D3541h], esi 0x00000011 push 00000000h 0x00000013 mov si, ax 0x00000016 push 00000000h 0x00000018 jmp 00007F7085255324h 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 jc 00007F708525531Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10357A8 second address: 10357AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10357AE second address: 10357B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103552C second address: 1035531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035531 second address: 1035537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103623C second address: 1036240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036240 second address: 103629E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F7085255321h 0x0000000e mov esi, dword ptr [ebp+122D2E4Eh] 0x00000014 push 00000000h 0x00000016 mov edi, 14B8FC8Ah 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F7085255318h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 jmp 00007F708525531Bh 0x0000003c push eax 0x0000003d js 00007F7085255324h 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103629E second address: 10362A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A12E second address: 103A138 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F708525531Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A138 second address: 103A15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D2A5Eh], edx 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D33FEh] 0x00000017 push 00000000h 0x00000019 mov ebx, dword ptr [ebp+12483AD7h] 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B130 second address: 103B134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B134 second address: 103B142 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A2DF second address: 103A2E9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7085255316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A2E9 second address: 103A2EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A2EF second address: 103A2F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B33A second address: 103B3B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, ecx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+124849DBh], esi 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F7084E7CE38h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a add bx, 3752h 0x0000003f mov bl, E8h 0x00000041 mov edi, dword ptr [ebp+122D1C37h] 0x00000047 mov eax, dword ptr [ebp+122D00C1h] 0x0000004d mov edi, dword ptr [ebp+122D1EC7h] 0x00000053 push FFFFFFFFh 0x00000055 mov bx, cx 0x00000058 nop 0x00000059 jne 00007F7084E7CE42h 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 push edx 0x00000065 pop edx 0x00000066 popad 0x00000067 push eax 0x00000068 push edx 0x00000069 jc 00007F7084E7CE36h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C21E second address: 103C2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255329h 0x00000009 popad 0x0000000a pushad 0x0000000b jne 00007F7085255316h 0x00000011 jno 00007F7085255316h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a jp 00007F708525532Ch 0x00000020 nop 0x00000021 je 00007F708525531Ch 0x00000027 mov edi, dword ptr [ebp+122D32BAh] 0x0000002d adc bl, FFFFFF83h 0x00000030 push dword ptr fs:[00000000h] 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F7085255318h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 mov ebx, dword ptr [ebp+122D2F56h] 0x00000057 mov ebx, dword ptr [ebp+122D2E7Eh] 0x0000005d mov dword ptr [ebp+1247BC3Dh], ebx 0x00000063 mov dword ptr fs:[00000000h], esp 0x0000006a jnp 00007F7085255318h 0x00000070 mov ebx, eax 0x00000072 mov eax, dword ptr [ebp+122D10B9h] 0x00000078 mov edi, 2FD24F22h 0x0000007d push FFFFFFFFh 0x0000007f mov edi, dword ptr [ebp+122D3165h] 0x00000085 nop 0x00000086 jng 00007F7085255324h 0x0000008c push eax 0x0000008d push edx 0x0000008e push edx 0x0000008f pop edx 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C2DC second address: 103C2E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103DFFA second address: 103E01F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F708525531Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7085255322h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E325 second address: 103E345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F7084E7CE36h 0x00000009 jmp 00007F7084E7CE3Eh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E345 second address: 103E349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E349 second address: 103E379 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7084E7CE44h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F235 second address: 103F24C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7085255323h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F24C second address: 103F250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F250 second address: 103F26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F708525531Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104020A second address: 1040214 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104307B second address: 1043080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043080 second address: 1043092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7084E7CE36h 0x0000000a jnp 00007F7084E7CE36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043092 second address: 10430A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F7085255316h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10430A1 second address: 10430A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043675 second address: 1043679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044692 second address: 10446F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 sub dword ptr [ebp+122D3179h], esi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F7084E7CE38h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a or dword ptr [ebp+122D3154h], edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F7084E7CE38h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c mov ebx, ecx 0x0000004e mov di, dx 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446F6 second address: 10446FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446FA second address: 10446FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446FE second address: 1044704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104565C second address: 1045661 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043863 second address: 1043874 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046939 second address: 104693E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043874 second address: 10438FB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007F7085255316h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bx, ax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov edi, 0B6CE88Eh 0x0000001e jng 00007F708525531Dh 0x00000024 jns 00007F7085255317h 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 sub dword ptr [ebp+122D377Dh], esi 0x00000037 mov eax, dword ptr [ebp+122D03B5h] 0x0000003d call 00007F7085255320h 0x00000042 mov ebx, dword ptr [ebp+122D3735h] 0x00000048 pop edi 0x00000049 push FFFFFFFFh 0x0000004b push edi 0x0000004c mov dword ptr [ebp+122D1D8Eh], edi 0x00000052 pop ebx 0x00000053 or edi, dword ptr [ebp+122D2EAAh] 0x00000059 nop 0x0000005a jmp 00007F7085255326h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jbe 00007F7085255318h 0x00000068 push ebx 0x00000069 pop ebx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10486F6 second address: 1048705 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104783A second address: 1047844 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7085255316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A5B2 second address: 104A5BC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497C9 second address: 10497CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104C744 second address: 104C762 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7084E7CE38h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7084E7CE40h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF35D1 second address: FF35E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F7085255316h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF35E0 second address: FF35FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7084E7CE3Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF35FC second address: FF3604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3604 second address: FF3608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE795E second address: FE7966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7966 second address: FE799D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE48h 0x00000007 jmp 00007F7084E7CE45h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10556FA second address: 10556FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10556FF second address: 1055705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055705 second address: 1055711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055711 second address: 105571E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F7084E7CE47h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105571E second address: 105572D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F708525531Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105587D second address: 1055883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055883 second address: 105588D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7085255316h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AE49 second address: 105AE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AE4D second address: 105AE5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AE5E second address: 105AE63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AF26 second address: 105AF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106016B second address: 1060171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060171 second address: 1060175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060789 second address: 106078D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106078D second address: 1060795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060A40 second address: 1060A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060A44 second address: 1060A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7085255325h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060B9A second address: 1060BB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F7084E7CE43h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F7084E7CE3Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060D03 second address: 1060D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7085255316h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F708525531Ah 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7085255328h 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e jmp 00007F7085255327h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060D50 second address: 1060D56 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060D56 second address: 1060D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060D5C second address: 1060D62 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060EBB second address: 1060EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060EBF second address: 1060EE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F7084E7CE48h 0x0000000c jmp 00007F7084E7CE42h 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ecx 0x00000014 jng 00007F7084E7CE36h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066EE3 second address: 1066F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7085255328h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066F05 second address: 1066F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065B60 second address: 1065B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065B65 second address: 1065B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065B6B second address: 1065B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065CF2 second address: 1065CFF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F7084E7CE36h 0x00000009 pop ecx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066283 second address: 1066299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10663F9 second address: 1066422 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7084E7CE47h 0x00000008 jmp 00007F7084E7CE3Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066422 second address: 1066432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jc 00007F708525531Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106658F second address: 1066595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066595 second address: 10665A2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7085255318h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066758 second address: 106675C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10668B5 second address: 10668B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10668B9 second address: 10668BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA0CA second address: FFA0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F7085255316h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA0D8 second address: FFA0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D388 second address: 106D3A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255325h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3A1 second address: 106D3A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3A9 second address: 106D3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3AD second address: 106D3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071A8C second address: 1071A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071A90 second address: 1071A95 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071A95 second address: 1071AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F7085255322h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071D0B second address: 1071D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071FEA second address: 1071FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072120 second address: 1072124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072124 second address: 1072146 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7085255316h 0x00000008 jmp 00007F7085255323h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072146 second address: 107214C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10717A5 second address: 10717B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072571 second address: 1072586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jns 00007F7084E7CE36h 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F7084E7CE36h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072586 second address: 1072592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7085255316h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072592 second address: 1072596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072596 second address: 107259C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10372C5 second address: 1037340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F7084E7CE38h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 movzx edi, cx 0x0000002a lea eax, dword ptr [ebp+1248C06Bh] 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F7084E7CE38h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a mov ecx, dword ptr [ebp+122D2EBEh] 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F7084E7CE3Dh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037340 second address: 1037346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037346 second address: 103734C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103734C second address: 1037350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037350 second address: 1037354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037354 second address: 1015F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jnl 00007F708525532Ah 0x00000010 pop ecx 0x00000011 nop 0x00000012 adc ecx, 5950DCCEh 0x00000018 call dword ptr [ebp+122D3883h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 jmp 00007F7085255325h 0x00000026 jne 00007F7085255316h 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10376BC second address: 10376D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10376D5 second address: 10376F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F7085255324h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10376F8 second address: 1037702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7084E7CE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037702 second address: 1037706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10378C0 second address: 10378C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10378C4 second address: 10378FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 ja 00007F7085255323h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007F7085255323h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10378FD second address: 1037925 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7084E7CE3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b cld 0x0000000c call 00007F7084E7CE39h 0x00000011 push esi 0x00000012 push esi 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pushad 0x0000001c popad 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037925 second address: 1037964 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7085255323h 0x00000008 jmp 00007F708525531Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 jne 00007F708525531Ch 0x0000001b pop eax 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037964 second address: 1037969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037A6A second address: 1037A80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F7085255316h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037BB7 second address: 1037BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037E01 second address: 1037E1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F7085255320h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037E1F second address: 1037E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038289 second address: 10382D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 0000001Eh 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F7085255318h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 and ecx, dword ptr [ebp+122D2F42h] 0x0000002b call 00007F7085255322h 0x00000030 cmc 0x00000031 pop edi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10383C1 second address: 10383C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10383C7 second address: 10383CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10383CC second address: 10383D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038696 second address: 10386AD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F708525531Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386AD second address: 10386BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE3Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386BC second address: 10386E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 or ecx, dword ptr [ebp+122D3500h] 0x0000000f lea eax, dword ptr [ebp+1248C06Bh] 0x00000015 mov edi, dword ptr [ebp+122D3518h] 0x0000001b jmp 00007F708525531Ah 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386E7 second address: 10386F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7084E7CE36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076514 second address: 107651A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076690 second address: 107669C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7084E7CE36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107669C second address: 10766E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F708525531Ch 0x0000000b jc 00007F7085255316h 0x00000011 jnl 00007F7085255316h 0x00000017 popad 0x00000018 push eax 0x00000019 jc 00007F7085255316h 0x0000001f pop eax 0x00000020 popad 0x00000021 pushad 0x00000022 jns 00007F7085255318h 0x00000028 jmp 00007F7085255320h 0x0000002d push eax 0x0000002e push edx 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10766E1 second address: 10766E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10766E5 second address: 1076700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F708525531Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F7085255316h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769A9 second address: 10769AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076C34 second address: 1076C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255328h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076D98 second address: 1076DB0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F7084E7CE42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076DB0 second address: 1076DBA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F708525531Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C183 second address: 107C189 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B9EA second address: 107B9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BE7F second address: 107BE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7084E7CE40h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BE94 second address: 107BE9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BE9A second address: 107BE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E316 second address: 107E31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E31A second address: 107E320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E320 second address: 107E335 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7085255318h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F7085255348h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10829E8 second address: 10829EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10829EC second address: 10829F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082B81 second address: 1082B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082FE5 second address: 1082FEF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7085255316h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082FEF second address: 1082FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F7084E7CE3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083125 second address: 1083149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F708525531Eh 0x0000000d jmp 00007F708525531Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083149 second address: 1083151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083151 second address: 1083161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F708525532Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083161 second address: 1083175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7084E7CE40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083175 second address: 108317D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108317D second address: 1083181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083181 second address: 1083185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084C61 second address: 1084C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084C6A second address: 1084C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255326h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10890BA second address: 10890C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10890C0 second address: 1089107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F7085255327h 0x0000000d pop esi 0x0000000e jmp 00007F7085255326h 0x00000013 popad 0x00000014 pushad 0x00000015 jns 00007F708525531Ch 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089107 second address: 1089114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103807D second address: 1038081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089A7D second address: 1089A81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E536 second address: 108E53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E53C second address: 108E542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E542 second address: 108E55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255323h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E55D second address: 108E567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E567 second address: 108E572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7085255316h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DE95 second address: 108DE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DE99 second address: 108DECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F7085255318h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F708525531Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DECB second address: 108DED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DED1 second address: 108DED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DED6 second address: 108DEFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F7084E7CE36h 0x00000009 jmp 00007F7084E7CE49h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DEFA second address: 108DF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E1F5 second address: 108E23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F7084E7CE36h 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007F7084E7CE36h 0x0000001a pop edi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7084E7CE44h 0x00000023 jmp 00007F7084E7CE48h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E23F second address: 108E248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E248 second address: 108E261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F7084E7CE41h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094AEB second address: 1094AF6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F7085255316h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094D9B second address: 1094DDA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F7084E7CE3Dh 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 popad 0x00000016 push ebx 0x00000017 pushad 0x00000018 jns 00007F7084E7CE36h 0x0000001e jmp 00007F7084E7CE47h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10956BD second address: 10956C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10956C1 second address: 10956C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10962E6 second address: 1096309 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Ch 0x00000007 pushad 0x00000008 jmp 00007F708525531Ch 0x0000000d jg 00007F7085255316h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096309 second address: 1096329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7084E7CE44h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096329 second address: 1096332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096332 second address: 1096338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096338 second address: 109633C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109633C second address: 1096342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A8A6 second address: 109A8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7085255326h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F7085255320h 0x00000014 jmp 00007F7085255325h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099AA9 second address: 1099AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099C27 second address: 1099C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099DC2 second address: 1099DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099DC8 second address: 1099DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099EF7 second address: 1099EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A429 second address: 109A42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6E7E second address: 10A6EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7084E7CE46h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push esi 0x0000000d jne 00007F7084E7CE36h 0x00000013 pop esi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7084E7CE48h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6EBE second address: 10A6ECA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F708525531Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6ECA second address: 10A6EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007F7084E7CE3Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A50CC second address: 10A50F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 pushad 0x00000008 jns 00007F7085255316h 0x0000000e jmp 00007F7085255329h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A50F4 second address: 10A510A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A554F second address: 10A5553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A567E second address: 10A568A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7084E7CE36h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5807 second address: 10A580D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A65B3 second address: 10A65B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A65B9 second address: 10A65BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A932D second address: 10A9340 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7084E7CE38h 0x00000008 push edx 0x00000009 ja 00007F7084E7CE36h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF9FB second address: 10AFA0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F708525531Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFA0D second address: 10AFA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7084E7CE3Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFB54 second address: 10AFB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F7085255322h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2E58 second address: 10B2E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnc 00007F7084E7CE38h 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e jmp 00007F7084E7CE48h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE864 second address: 10BE868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE9A2 second address: 10BE9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jg 00007F7084E7CE36h 0x0000000b jmp 00007F7084E7CE3Ch 0x00000010 jmp 00007F7084E7CE43h 0x00000015 popad 0x00000016 jg 00007F7084E7CE42h 0x0000001c jmp 00007F7084E7CE3Ah 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 popad 0x00000024 jnp 00007F7084E7CE51h 0x0000002a ja 00007F7084E7CE3Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3ACB second address: 10C3AD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3AD1 second address: 10C3ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3ADB second address: 10C3AED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CDE51 second address: 10CDE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CDE57 second address: 10CDE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DA604 second address: 10DA60E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F7084E7CE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB395 second address: 10DB3B1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7085255316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F7085255316h 0x00000011 je 00007F7085255316h 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF0F5 second address: 10DF0F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF0F9 second address: 10DF10E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F708525531Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF10E second address: 10DF112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1F82 second address: 10F1F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7085255328h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1F9F second address: 10F1FA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1FA4 second address: 10F1FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1DEB second address: 10F1DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1DEF second address: 10F1DFF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7085255316h 0x00000008 jnc 00007F7085255316h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E940E second address: 10E9418 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7084E7CE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9418 second address: 10E9434 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7085255318h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jp 00007F7085255316h 0x00000012 jbe 00007F7085255316h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118FCA second address: 1118FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11183F7 second address: 11183FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11183FC second address: 1118402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118402 second address: 1118408 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118408 second address: 111842A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F7084E7CE3Ch 0x0000000f jng 00007F7084E7CE36h 0x00000015 pushad 0x00000016 js 00007F7084E7CE36h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111842A second address: 1118430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A65D second address: 111A663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A663 second address: 111A667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A667 second address: 111A673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A673 second address: 111A67C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A67C second address: 111A682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EA57 second address: 111EAA7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F708525531Ch 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F7085255318h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push edi 0x00000027 mov dx, di 0x0000002a pop edx 0x0000002b clc 0x0000002c push 00000004h 0x0000002e mov dword ptr [ebp+12483491h], ecx 0x00000034 push EF2AA09Ah 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c jo 00007F7085255316h 0x00000042 push eax 0x00000043 pop eax 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11201F9 second address: 1120216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7084E7CE49h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120216 second address: 112021A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112021A second address: 1120246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7084E7CE3Eh 0x0000000c jnp 00007F7084E7CE3Ch 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jc 00007F7084E7CE36h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960152 second address: 4960170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c mov ebx, 44A47726h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 mov cx, 08B9h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950008 second address: 495000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495000E second address: 4950014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950014 second address: 49500B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F7084E7CE48h 0x0000000f mov ax, C881h 0x00000013 popad 0x00000014 mov dword ptr [esp], ebp 0x00000017 pushad 0x00000018 mov cx, 06B9h 0x0000001c call 00007F7084E7CE46h 0x00000021 pushfd 0x00000022 jmp 00007F7084E7CE42h 0x00000027 sub eax, 0A3CA9F8h 0x0000002d jmp 00007F7084E7CE3Bh 0x00000032 popfd 0x00000033 pop eax 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 pushad 0x00000038 mov eax, edx 0x0000003a movsx ebx, ax 0x0000003d popad 0x0000003e pop ebp 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov di, 8458h 0x00000046 pushfd 0x00000047 jmp 00007F7084E7CE41h 0x0000004c jmp 00007F7084E7CE3Bh 0x00000051 popfd 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980DF6 second address: 4980E11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E11 second address: 4980E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 mov bh, EEh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov esi, 2FA51525h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E25 second address: 4980E43 instructions: 0x00000000 rdtsc 0x00000002 mov ax, DEA1h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F708525531Eh 0x0000000d popad 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E43 second address: 4980E49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E49 second address: 4980E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E4F second address: 4980E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920144 second address: 4920148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920148 second address: 492014E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492014E second address: 4920155 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ah 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920155 second address: 4920175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push dword ptr [ebp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7084E7CE44h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920175 second address: 49201BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F708525531Bh 0x00000015 adc ecx, 7F3D8F9Eh 0x0000001b jmp 00007F7085255329h 0x00000020 popfd 0x00000021 mov si, AF67h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49201F1 second address: 49201F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49201F5 second address: 49201F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49201F9 second address: 49201FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49201FF second address: 4920205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920205 second address: 4920209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940C54 second address: 4940CE4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F708525531Bh 0x00000008 adc ecx, 27DA3A1Eh 0x0000000e jmp 00007F7085255329h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [esp], ebp 0x0000001a pushad 0x0000001b pushad 0x0000001c mov ax, BD39h 0x00000020 jmp 00007F7085255326h 0x00000025 popad 0x00000026 pushfd 0x00000027 jmp 00007F7085255322h 0x0000002c add ecx, 2CC7FA78h 0x00000032 jmp 00007F708525531Bh 0x00000037 popfd 0x00000038 popad 0x00000039 mov ebp, esp 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F7085255325h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49407F7 second address: 49407FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49407FD second address: 4940801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940801 second address: 4940805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940805 second address: 4940814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940814 second address: 4940818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940818 second address: 494081E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494081E second address: 4940843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7084E7CE48h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940843 second address: 4940847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940847 second address: 494084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494084D second address: 494089E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F708525531Eh 0x00000012 jmp 00007F7085255325h 0x00000017 popfd 0x00000018 movzx esi, di 0x0000001b popad 0x0000001c pop ebp 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F708525531Fh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494089E second address: 49408A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49406CB second address: 49406D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49406D1 second address: 4940794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 3964B9C8h 0x00000008 jmp 00007F7084E7CE41h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F7084E7CE3Eh 0x00000016 push eax 0x00000017 pushad 0x00000018 mov di, 72D4h 0x0000001c jmp 00007F7084E7CE3Dh 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F7084E7CE3Eh 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b mov al, 2Dh 0x0000002d pushfd 0x0000002e jmp 00007F7084E7CE43h 0x00000033 adc ecx, 333ABACEh 0x00000039 jmp 00007F7084E7CE49h 0x0000003e popfd 0x0000003f popad 0x00000040 pop ebp 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007F7084E7CE43h 0x0000004a sbb ax, 88DEh 0x0000004f jmp 00007F7084E7CE49h 0x00000054 popfd 0x00000055 mov bx, cx 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940794 second address: 494079A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494079A second address: 494079E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494079E second address: 49407A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940444 second address: 4940457 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940457 second address: 49404AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007F7085255329h 0x00000015 adc ecx, 0AF43CE6h 0x0000001b jmp 00007F7085255321h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49404AD second address: 49404F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7084E7CE47h 0x00000009 jmp 00007F7084E7CE43h 0x0000000e popfd 0x0000000f movzx ecx, bx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 mov ecx, 2C37DDE7h 0x0000001c mov di, ax 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 mov ebx, ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 mov ax, 82ADh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49404F7 second address: 4940530 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F7085255321h 0x00000013 sub ax, 3FB6h 0x00000018 jmp 00007F7085255321h 0x0000001d popfd 0x0000001e mov ebx, esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940530 second address: 4940538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980CEC second address: 4980CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980CF2 second address: 4980CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980CF6 second address: 4980D22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7085255327h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980D22 second address: 4980D6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, 2B761668h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F7084E7CE43h 0x00000017 and eax, 7E4449AEh 0x0000001d jmp 00007F7084E7CE49h 0x00000022 popfd 0x00000023 mov ah, 66h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980D6A second address: 4980DA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d jmp 00007F708525531Ah 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7085255327h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496047B second address: 496047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496047F second address: 4960485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960485 second address: 49604B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7084E7CE3Ah 0x00000008 mov bx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7084E7CE46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604B3 second address: 49604B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604B9 second address: 49604CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604CA second address: 49604E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7085255323h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604E8 second address: 4960556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F7084E7CE3Bh 0x00000015 sub al, FFFFFF9Eh 0x00000018 jmp 00007F7084E7CE49h 0x0000001d popfd 0x0000001e mov dx, cx 0x00000021 popad 0x00000022 mov eax, dword ptr [ebp+08h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F7084E7CE49h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960556 second address: 496059D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F7085255323h 0x00000015 jmp 00007F7085255323h 0x0000001a popfd 0x0000001b movzx esi, bx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494063B second address: 4940641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940641 second address: 4940680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov bh, cl 0x0000000c mov dh, 0Ah 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F708525531Dh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov ax, F843h 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F7085255322h 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940680 second address: 4940684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940684 second address: 494068A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496006A second address: 4960070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960070 second address: 4960074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960074 second address: 4960096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7084E7CE42h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960096 second address: 496009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496009A second address: 496009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496009E second address: 49600A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49600A4 second address: 49600AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49600AA second address: 49600AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49600AE second address: 49600D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov al, 2Ah 0x00000010 mov edx, 380FCF7Eh 0x00000015 popad 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49600D4 second address: 49600D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49600D8 second address: 49600DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496028C second address: 4960292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960292 second address: 4960296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960296 second address: 49602C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7085255320h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602C4 second address: 49602C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602C8 second address: 49602CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602CE second address: 49602DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602DF second address: 49602F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, E3C5h 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602F5 second address: 49602F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602F9 second address: 49602FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602FD second address: 4960303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960303 second address: 4960312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F708525531Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498062E second address: 4980650 instructions: 0x00000000 rdtsc 0x00000002 mov bh, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7084E7CE46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980650 second address: 4980656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980656 second address: 4980693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bl, EEh 0x00000011 pushfd 0x00000012 jmp 00007F7084E7CE48h 0x00000017 adc esi, 74D37C58h 0x0000001d jmp 00007F7084E7CE3Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980693 second address: 49806AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7085255324h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49806AB second address: 49806AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49806AF second address: 49806FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov di, F4D0h 0x0000000f pushfd 0x00000010 jmp 00007F7085255329h 0x00000015 jmp 00007F708525531Bh 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d pushad 0x0000001e movzx eax, dx 0x00000021 mov dx, F8F4h 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 pushad 0x00000029 mov esi, 05269DD5h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49806FD second address: 4980767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ecx 0x00000007 jmp 00007F7084E7CE46h 0x0000000c mov eax, dword ptr [76FA65FCh] 0x00000011 jmp 00007F7084E7CE40h 0x00000016 test eax, eax 0x00000018 jmp 00007F7084E7CE40h 0x0000001d je 00007F70F742005Bh 0x00000023 jmp 00007F7084E7CE40h 0x00000028 mov ecx, eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F7084E7CE3Ah 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980767 second address: 498076B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498076B second address: 4980771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980771 second address: 4980800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov di, D812h 0x00000011 mov edx, 27FD635Eh 0x00000016 popad 0x00000017 and ecx, 1Fh 0x0000001a jmp 00007F7085255325h 0x0000001f ror eax, cl 0x00000021 jmp 00007F708525531Eh 0x00000026 leave 0x00000027 pushad 0x00000028 push ecx 0x00000029 movsx edx, cx 0x0000002c pop ecx 0x0000002d mov bx, 827Ah 0x00000031 popad 0x00000032 retn 0004h 0x00000035 nop 0x00000036 mov esi, eax 0x00000038 lea eax, dword ptr [ebp-08h] 0x0000003b xor esi, dword ptr [00E72014h] 0x00000041 push eax 0x00000042 push eax 0x00000043 push eax 0x00000044 lea eax, dword ptr [ebp-10h] 0x00000047 push eax 0x00000048 call 00007F7088DA5A1Eh 0x0000004d push FFFFFFFEh 0x0000004f pushad 0x00000050 mov bx, E6D2h 0x00000054 push eax 0x00000055 push edx 0x00000056 pushfd 0x00000057 jmp 00007F7085255329h 0x0000005c adc ah, FFFFFFA6h 0x0000005f jmp 00007F7085255321h 0x00000064 popfd 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980800 second address: 4980804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980804 second address: 49808ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 pushad 0x00000009 call 00007F708525531Ah 0x0000000e push esi 0x0000000f pop ebx 0x00000010 pop esi 0x00000011 jmp 00007F7085255327h 0x00000016 popad 0x00000017 ret 0x00000018 nop 0x00000019 push eax 0x0000001a call 00007F7088DA5A82h 0x0000001f mov edi, edi 0x00000021 pushad 0x00000022 jmp 00007F7085255324h 0x00000027 pushfd 0x00000028 jmp 00007F7085255322h 0x0000002d sub esi, 7A76A808h 0x00000033 jmp 00007F708525531Bh 0x00000038 popfd 0x00000039 popad 0x0000003a xchg eax, ebp 0x0000003b pushad 0x0000003c mov bx, ax 0x0000003f pushfd 0x00000040 jmp 00007F7085255320h 0x00000045 xor ax, CA68h 0x0000004a jmp 00007F708525531Bh 0x0000004f popfd 0x00000050 popad 0x00000051 push eax 0x00000052 jmp 00007F7085255329h 0x00000057 xchg eax, ebp 0x00000058 jmp 00007F708525531Eh 0x0000005d mov ebp, esp 0x0000005f jmp 00007F7085255320h 0x00000064 pop ebp 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F7085255327h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493001B second address: 4930033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930033 second address: 4930062 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F7085255326h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930062 second address: 4930066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930066 second address: 493006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493006A second address: 4930070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930070 second address: 4930098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 555B2498h 0x00000008 jmp 00007F7085255321h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 mov edx, 0C51DE0Ch 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930098 second address: 49300AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7084E7CE41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49300AD second address: 49300BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bh, 52h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49300BE second address: 49300E3 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 31650317h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a and esp, FFFFFFF8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7084E7CE44h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49300E3 second address: 49300F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49300F2 second address: 49300F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49300F8 second address: 49300FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49300FC second address: 493010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493010B second address: 4930111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930111 second address: 493012E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493012E second address: 4930132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930132 second address: 4930136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930136 second address: 493013C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493013C second address: 49301D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7084E7CE3Eh 0x00000011 and cl, FFFFFFD8h 0x00000014 jmp 00007F7084E7CE3Bh 0x00000019 popfd 0x0000001a push esi 0x0000001b mov esi, ebx 0x0000001d pop edx 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 jmp 00007F7084E7CE47h 0x00000026 pushfd 0x00000027 jmp 00007F7084E7CE48h 0x0000002c sub si, B798h 0x00000031 jmp 00007F7084E7CE3Bh 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F7084E7CE45h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49301D5 second address: 49301F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, cx 0x00000012 mov al, BDh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49301F6 second address: 49301FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49301FB second address: 4930209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930209 second address: 493020F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493020F second address: 4930241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255328h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F708525531Bh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cx, dx 0x00000016 mov esi, edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930241 second address: 4930247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930247 second address: 493027E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F7085255320h 0x00000013 xchg eax, edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop esi 0x00000019 mov ebx, 476A66ECh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493027E second address: 49302CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7084E7CE41h 0x00000011 or cx, AD76h 0x00000016 jmp 00007F7084E7CE41h 0x0000001b popfd 0x0000001c mov cx, B467h 0x00000020 popad 0x00000021 xchg eax, edi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49302CB second address: 49302CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49302CF second address: 49302DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49302DE second address: 49302F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7085255324h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49302F6 second address: 4930390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e mov esi, 195EAA4Bh 0x00000013 jmp 00007F7084E7CE40h 0x00000018 popad 0x00000019 je 00007F70F746B12Bh 0x0000001f jmp 00007F7084E7CE40h 0x00000024 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002b jmp 00007F7084E7CE40h 0x00000030 je 00007F70F746B114h 0x00000036 jmp 00007F7084E7CE40h 0x0000003b mov edx, dword ptr [esi+44h] 0x0000003e pushad 0x0000003f mov bx, cx 0x00000042 pushfd 0x00000043 jmp 00007F7084E7CE3Ah 0x00000048 xor esi, 0F371418h 0x0000004e jmp 00007F7084E7CE3Bh 0x00000053 popfd 0x00000054 popad 0x00000055 or edx, dword ptr [ebp+0Ch] 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930390 second address: 4930397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930397 second address: 493046F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F7084E7CE44h 0x00000016 or eax, 4FAA98D8h 0x0000001c jmp 00007F7084E7CE3Bh 0x00000021 popfd 0x00000022 mov dl, ch 0x00000024 popad 0x00000025 jne 00007F70F746B0DFh 0x0000002b jmp 00007F7084E7CE3Bh 0x00000030 test byte ptr [esi+48h], 00000001h 0x00000034 pushad 0x00000035 mov ecx, 7CBA339Bh 0x0000003a call 00007F7084E7CE40h 0x0000003f pushfd 0x00000040 jmp 00007F7084E7CE42h 0x00000045 or ah, FFFFFF98h 0x00000048 jmp 00007F7084E7CE3Bh 0x0000004d popfd 0x0000004e pop ecx 0x0000004f popad 0x00000050 jne 00007F70F746B0A9h 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007F7084E7CE47h 0x0000005f or si, CB0Eh 0x00000064 jmp 00007F7084E7CE49h 0x00000069 popfd 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493046F second address: 4930475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930475 second address: 4930479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492080D second address: 4920811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920811 second address: 4920815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920815 second address: 492081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492081B second address: 4920821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920821 second address: 4920859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F7085255320h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F708525531Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920859 second address: 49208B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F7084E7CE46h 0x0000000f xchg eax, esi 0x00000010 jmp 00007F7084E7CE40h 0x00000015 push eax 0x00000016 jmp 00007F7084E7CE3Bh 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7084E7CE45h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49208B4 second address: 4920905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, 235D9C3Eh 0x00000014 pushfd 0x00000015 jmp 00007F708525531Fh 0x0000001a add ecx, 374790EEh 0x00000020 jmp 00007F7085255329h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920905 second address: 492090A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492090A second address: 4920932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F7085255321h 0x00000016 pop eax 0x00000017 mov di, A944h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920932 second address: 4920937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920937 second address: 4920948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, 41h 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920948 second address: 492094C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492094C second address: 4920952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920952 second address: 4920958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920958 second address: 49209EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F70F784AD44h 0x0000000e pushad 0x0000000f mov esi, edi 0x00000011 call 00007F7085255325h 0x00000016 mov bx, cx 0x00000019 pop ecx 0x0000001a popad 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 pushad 0x00000023 mov edi, 35E2C59Ch 0x00000028 call 00007F7085255325h 0x0000002d call 00007F7085255320h 0x00000032 pop esi 0x00000033 pop edi 0x00000034 popad 0x00000035 mov ecx, esi 0x00000037 jmp 00007F708525531Eh 0x0000003c je 00007F70F784ACF1h 0x00000042 jmp 00007F7085255320h 0x00000047 test byte ptr [76FA6968h], 00000002h 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49209EB second address: 49209EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49209EF second address: 49209F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49209F5 second address: 4920A77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F70F74727DFh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F7084E7CE3Eh 0x00000016 sub ax, B9D8h 0x0000001b jmp 00007F7084E7CE3Bh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F7084E7CE48h 0x00000027 sbb ch, 00000038h 0x0000002a jmp 00007F7084E7CE3Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov edx, dword ptr [ebp+0Ch] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F7084E7CE45h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920A77 second address: 4920AAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7085255329h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AAC second address: 4920AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AB2 second address: 4920AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AB6 second address: 4920ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920ABA second address: 4920ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx ebx, cx 0x0000000f mov dx, cx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920ACD second address: 4920AD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AD2 second address: 4920AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AE0 second address: 4920AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AE6 second address: 4920AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7085255321h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AFB second address: 4920AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920AFF second address: 4920B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920B0E second address: 4920B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920B12 second address: 4920B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920B16 second address: 4920B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920B1C second address: 4920B4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F708525531Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7085255327h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920B4A second address: 4920BC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c pushad 0x0000000d mov si, EB33h 0x00000011 pushfd 0x00000012 jmp 00007F7084E7CE48h 0x00000017 and ah, 00000038h 0x0000001a jmp 00007F7084E7CE3Bh 0x0000001f popfd 0x00000020 popad 0x00000021 push dword ptr [ebp+10h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F7084E7CE3Bh 0x0000002d jmp 00007F7084E7CE43h 0x00000032 popfd 0x00000033 mov eax, 68E05B4Fh 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920BC4 second address: 4920BCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C2F second address: 4920C46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7084E7CE43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4920C46 second address: 4920C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930DCB second address: 4930E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007F7084E7CE48h 0x0000000b sbb ax, 74C8h 0x00000010 jmp 00007F7084E7CE3Bh 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F7084E7CE46h 0x0000001d push eax 0x0000001e jmp 00007F7084E7CE3Bh 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930E25 second address: 4930E40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7085255327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930E40 second address: 4930E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E7EAFF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1051A9E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1037450 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10B7C1A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1FEAFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3D1A9E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3B7450 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 437C1A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Special instruction interceptor: First address: FBDE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Special instruction interceptor: First address: 104F426 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Special instruction interceptor: First address: BC7858 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Special instruction interceptor: First address: BC795D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Special instruction interceptor: First address: D5ABEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Special instruction interceptor: First address: D64DB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Special instruction interceptor: First address: DE1F4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Special instruction interceptor: First address: A1FDF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Special instruction interceptor: First address: BDDBE5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Special instruction interceptor: First address: C52E50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Special instruction interceptor: First address: 9BDD2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Special instruction interceptor: First address: 9BDC60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Special instruction interceptor: First address: B69739 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Memory allocated: E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Memory allocated: 2830000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Memory allocated: 4830000 memory reserve \| memory write watch
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Memory allocated: 18167770000 memory reserve \| memory write watch
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Memory allocated: 18169150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Memory allocated: 49A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Memory allocated: 4B20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Memory allocated: 6B20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 13E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 2D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 4D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 53F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 63F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 6520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 7520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: B490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: C490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: C920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: D920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: F170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 10170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory allocated: 11170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Memory allocated: 50A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Memory allocated: 52C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Memory allocated: 5110000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_049A0C4E rdtsc

0_2_049A0C4E

Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Thread delayed: delay time: 922337203685477
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Thread delayed: delay time: 922337203685477
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1189	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1317	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Window / User API: threadDelayed 3287
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Window / User API: threadDelayed 6512
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6497
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3192
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7599
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2103
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Window / User API: threadDelayed 725
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1240
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1163
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1144
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1183
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1201
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1203
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1138
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1148
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 999
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 444
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1137
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1159
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1134
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1121
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Window / User API: threadDelayed 1144

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017989001\4c7aea0d0a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017991001\617d9fb7ad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017983001\f71e300ff9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017999001\daaacc90a2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017986001\5dfec4fe99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4124	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4124	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4764	Thread sleep count: 1189 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4764	Thread sleep time: -2379189s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3868	Thread sleep count: 262 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3868	Thread sleep time: -7860000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828	Thread sleep count: 1317 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828	Thread sleep time: -2635317s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5148	Thread sleep count: 1313 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5148	Thread sleep time: -2627313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe TID: 1196	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe TID: 2676	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe TID: 5880	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe TID: 6496	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe TID: 4744	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe TID: 6556	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe TID: 6596	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99438s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -99094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98985s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98860s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98619s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98487s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -98081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97844s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97619s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97386s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97266s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -97032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96907s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96782s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96657s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96438s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96313s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -96063s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95948s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95828s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95719s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95605s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95486s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95366s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95250s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95137s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -95016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94891s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94813s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94688s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94576s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94454s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94329s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe TID: 5008	Thread sleep time: -94204s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6044	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3504	Thread sleep count: 7599 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3504	Thread sleep count: 2103 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3500	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5864	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5512	Thread sleep time: -30000s >= -30000s
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe TID: 720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe TID: 1580	Thread sleep time: -922337203685477s >= -30000s
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe TID: 4368	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 6056	Thread sleep count: 1240 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 6056	Thread sleep time: -2481240s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 1100	Thread sleep count: 1163 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 1100	Thread sleep time: -2327163s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 1628	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 2124	Thread sleep count: 1144 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 2124	Thread sleep time: -2289144s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 5648	Thread sleep count: 1183 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 5648	Thread sleep time: -2367183s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 3664	Thread sleep count: 1201 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 3664	Thread sleep time: -2403201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 5896	Thread sleep count: 1203 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 5896	Thread sleep time: -2407203s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3640	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5424	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 6624	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 6624	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 7060	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 7060	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 1380	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 1380	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5568	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5244	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 1844	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 1844	Thread sleep time: -90045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 2448	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5512	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5512	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5840	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 5840	Thread sleep time: -72036s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 2892	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 7160	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 1996	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 1656	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 7660	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 6220	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe TID: 6220	Thread sleep time: -72036s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe TID: 8772	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8580	Thread sleep count: 1138 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8580	Thread sleep time: -2277138s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8584	Thread sleep count: 1148 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8584	Thread sleep time: -2297148s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8588	Thread sleep count: 999 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8588	Thread sleep time: -1998999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8360	Thread sleep count: 444 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8360	Thread sleep time: -2664000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8596	Thread sleep count: 1137 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8596	Thread sleep time: -2275137s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8592	Thread sleep count: 1159 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8592	Thread sleep time: -2319159s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8572	Thread sleep count: 1134 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8572	Thread sleep time: -2269134s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8600	Thread sleep count: 1121 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8600	Thread sleep time: -2243121s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8576	Thread sleep count: 1144 > 30
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe TID: 8576	Thread sleep time: -2289144s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe TID: 7344	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe TID: 8012	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DC36A9 FindFirstFileExW,		7_2_00DC36A9
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DC375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,		7_2_00DC375A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99438
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99219
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 99094
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98985
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98860
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98735
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98619
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98487
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 98081
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97953
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97844
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97734
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97619
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97500
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97386
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97266
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97157
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 97032
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96907
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96782
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96657
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96547
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96438
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96313
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96188
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 96063
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95948
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95828
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95719
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95605
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95486
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95366
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95250
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95137
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 95016
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94891
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94813
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94688
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94576
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94454
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94329
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Thread delayed: delay time: 94204
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Thread delayed: delay time: 922337203685477
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Thread delayed: delay time: 922337203685477
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Thread delayed: delay time: 922337203685477

Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: skotes.exe, skotes.exe, 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmp, e565baa4b6.exe, 0000000A.00000002.3290323952.0000000000F9F000.00000040.00000001.01000000.0000000A.sdmp, 128703c003.exe, 00000012.00000002.3013125466.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 7ccdd68f3b.exe, 0000001B.00000002.3305532351.0000000001412000.00000004.00000020.00020000.00000000.sdmp, 7ccdd68f3b.exe, 0000001B.00000003.3290321113.00000000013E3000.00000004.00000020.00020000.00000000.sdmp, 7ccdd68f3b.exe, 0000001B.00000003.3299140187.0000000001411000.00000004.00000020.00020000.00000000.sdmp, 7ccdd68f3b.exe, 0000001B.00000003.3291479825.00000000013EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.8=
Source: 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001381000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3219575719.0000000005E84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: a2236cc5aa.exe, a2236cc5aa.exe, 00000009.00000003.3092499477.000000000122B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000122B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029437490.000000000122B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3006552725.000000000122D000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122658789.000000000122D000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.00000000011FC000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029644708.000000000122D000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3134231707.000000000122E000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3133480042.00000000011FC000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3285986121.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 7ccdd68f3b.exe, 0000001B.00000003.3237546090.000000000141F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"
Source: 3494904393.exe, 0000000B.00000002.3048855313.0000000000A82000.00000004.00000020.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3163410675.000001816AF72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 3494904393.exe, 0000000B.00000002.3048855313.0000000000B07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 128703c003.exe, 00000017.00000003.3219575719.0000000005E84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: e565baa4b6.exe, 0000000A.00000002.3283325885.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX,
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmp, e565baa4b6.exe, 0000000A.00000002.3290323952.0000000000F9F000.00000040.00000001.01000000.0000000A.sdmp, 128703c003.exe, 00000012.00000002.3013125466.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 128703c003.exe, 00000017.00000003.3215322011.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe

API call chain: ExitProcess graph end node

graph_7-14635

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_049A0C4E rdtsc

0_2_049A0C4E

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe

Code function: 7_2_00DB5020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00DB5020

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4652B mov eax, dword ptr fs:[00000030h]	0_2_00E4652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4A302 mov eax, dword ptr fs:[00000030h]	0_2_00E4A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001CA302 mov eax, dword ptr fs:[00000030h]	2_2_001CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001C652B mov eax, dword ptr fs:[00000030h]	2_2_001C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001CA302 mov eax, dword ptr fs:[00000030h]	3_2_001CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001C652B mov eax, dword ptr fs:[00000030h]	3_2_001C652B
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DD519E mov edi, dword ptr fs:[00000030h]	7_2_00DD519E
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB1614 mov edi, dword ptr fs:[00000030h]	7_2_00DB1614

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe

Code function: 7_2_00DBFE2C GetProcessHeap,

7_2_00DBFE2C

Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB5014 SetUnhandledExceptionFilter,	7_2_00DB5014
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB5020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00DB5020
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DBB4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00DBB4B9
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: 7_2_00DB4C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00DB4C64

Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 3494904393.exe PID: 6148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a13e339a3.exe PID: 3184, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe

Code function: 7_2_00DD519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

7_2_00DD519E

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click
Source: e565baa4b6.exe, 0000000A.00000003.2826158039.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: treehoneyi.click
Source: 128703c003.exe, 00000012.00000003.2969053173.0000000004B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe "C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe "C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe "C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe "C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe "C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe "C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe "C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Process created: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe "C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe "C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe"
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Process created: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe "C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe"
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "c:\program files\mozilla firefox\firefox.exe" -contentproc --channel=2172 -parentbuildid 20230927232528 -prefshandle 2120 -prefmaphandle 2112 -prefslen 25308 -prefmapsize 237879 -win32klockeddown -appdir "c:\program files\mozilla firefox\browser" - {d3116d80-26e5-4678-b47c-6e372794e0eb} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2800d16fd10 socket
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "c:\program files\mozilla firefox\firefox.exe" -contentproc --channel=2860 -parentbuildid 20230927232528 -prefshandle 4300 -prefmaphandle 4304 -prefslen 26395 -prefmapsize 237879 -appdir "c:\program files\mozilla firefox\browser" - {822619a6-5657-47d3-80bf-2521004ff1f0} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 28020772b10 rdd

Source: skotes.exe, skotes.exe, 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: =Program Manager
Source: 128703c003.exe, 00000012.00000002.3013125466.0000000000D3C000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: e565baa4b6.exe, 0000000A.00000002.3290323952.0000000000F9F000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: jLProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetLocaleInfoW,	7_2_00DC30D1
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: EnumSystemLocalesW,	7_2_00DC3086
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_00DC3178
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetLocaleInfoW,	7_2_00DC327E
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetLocaleInfoW,	7_2_00DBF21C
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_00DC2A13
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_00DC2CFF
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: EnumSystemLocalesW,	7_2_00DC2C64
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: GetLocaleInfoW,	7_2_00DC2FB1
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: EnumSystemLocalesW,	7_2_00DC2F52
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Code function: EnumSystemLocalesW,	7_2_00DBF717

Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017983001\f71e300ff9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017983001\f71e300ff9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017986001\5dfec4fe99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017986001\5dfec4fe99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017989001\4c7aea0d0a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017989001\4c7aea0d0a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017991001\617d9fb7ad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017991001\617d9fb7ad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017994001\98679d2b4b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017994001\98679d2b4b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017995001\8d966c471d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017995001\8d966c471d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017996001\9c5dc2c478.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017996001\9c5dc2c478.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017997001\4e48e9ad99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017997001\4e48e9ad99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017998001\ab2f510d23.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017998001\ab2f510d23.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\System32\WinMetadata\Windows.Globalization.winmd VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\System32\WinMetadata\Windows.Data.winmd VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPFED7C.tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E2CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00E2CBEA

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Overwrites Mozilla Firefox settings

Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite

Source: a2236cc5aa.exe, a2236cc5aa.exe, 00000009.00000003.3029437490.000000000122B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029378664.000000000382F000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3048971355.000000000382F000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029644708.000000000122D000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3034696471.000000000382F000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3141123651.000000000382F000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3047195115.000000000382F000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3213908752.0000000000874000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3288044439.000000000087B000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3190134926.000000000087B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 3.2.skotes.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2200230498.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2630147663.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2202358687.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2160698202.0000000004780000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 7ccdd68f3b.exe PID: 3848, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: a2236cc5aa.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e565baa4b6.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 128703c003.exe PID: 4088, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000030.00000003.3288737853.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3086871686.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8a13e339a3.exe PID: 3184, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 19.0.63506cf0a7384158900a9c4410789dbd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3494904393.exe PID: 6148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: a2236cc5aa.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: a2236cc5aa.exe	String found in binary or memory: Wallets/ElectronCash
Source: a2236cc5aa.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: a2236cc5aa.exe, 00000009.00000003.3006552725.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: a2236cc5aa.exe, 00000009.00000003.3006552725.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: a2236cc5aa.exe, 00000009.00000003.2973112098.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: a2236cc5aa.exe	String found in binary or memory: %appdata%\Ethereum
Source: a2236cc5aa.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: a2236cc5aa.exe, 00000009.00000003.3006808233.000000000120A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\key4.db
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI

Source: C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe	Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 00000017.00000003.3258078775.000000000169B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.3006312115.0000000001288000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3275631067.000000000169B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3258078775.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3500289993.0000000001354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3275631067.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3335757490.000000000169B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3503373239.0000000001355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3501962670.0000000001354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3334478529.000000000169B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a2236cc5aa.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e565baa4b6.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 128703c003.exe PID: 4088, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 7ccdd68f3b.exe PID: 3848, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: a2236cc5aa.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e565baa4b6.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 128703c003.exe PID: 4088, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000030.00000003.3288737853.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3086871686.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8a13e339a3.exe PID: 3184, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 19.0.63506cf0a7384158900a9c4410789dbd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3494904393.exe PID: 6148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63506cf0a7384158900a9c4410789dbd.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	23 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	256 System Information Discovery	SMB/Windows Admin Shares	41 Data from Local System	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	212 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	9101 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	381 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	381 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	54%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	67%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	81%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[5].exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	67%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe	67%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe	81%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe	54%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe	67%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1017994001\98679d2b4b.exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe	47%	ReversingLabs	Win32.Infostealer.Generic
C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe	0%	ReversingLabs

Name	Malicious	Reputation
https://steamcommunity.com/profiles/76561199809363512	false	high
aspecteirs.lat	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
pancakedipyps.click	false	high
necklacebudi.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://treehoneyi.click/eml7=	e565baa4b6.exe, 0000000A.00000003.3190256210.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/chrome_newtab	a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.datacontract.org	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/us	e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://frostman.shop/hA	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	a2236cc5aa.exe, 00000009.00000003.2976264747.0000000003848000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.datacontract.org/2004/07/StoreInstaller.Models	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000016.00000003.3061403026.0000019246380000.00000004.00000800.00020000.00000000.sdmp	false	high
https://t.me/k04ael	3494904393.exe, 0000000B.00000002.3054106984.000000000296B000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	false	high
http://185.215.113.16/off/def.exevh	128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/	a2236cc5aa.exe, a2236cc5aa.exe, 00000009.00000002.3133800466.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2972854469.0000000003834000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3092499477.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3034726949.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029644708.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122847906.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029780575.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3137538281.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://frostman.shop/yB	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/#	a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://grannyejh.lat:443/api	128703c003.exe, 00000012.00000003.3011066639.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000002.3012509947.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3168584611.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3411535571.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3368738714.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3334478529.0000000001679000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	powershell.exe, 0000000D.00000002.2914223441.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004541000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/apiup	128703c003.exe, 00000017.00000003.3168584611.000000000169B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2917207950.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://defaultcontainer/StoreInstaller;component/Resources/StoreAppList.Light.png	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.c	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3081412103.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3078242620.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3068983043.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe	3494904393.exe, 0000000B.00000002.3054106984.0000000002859000.00000004.00000800.00020000.00000000.sdmp, 3494904393.exe, 0000000B.00000000.2867570973.0000000000532000.00000002.00000001.01000000.0000000B.sdmp, 3494904393.exe, 0000000B.00000002.3054106984.0000000002842000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	3494904393.exe, 0000000B.00000002.3054106984.0000000002831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2914223441.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004541000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181003C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://pancakedipyps.click/api	a2236cc5aa.exe, a2236cc5aa.exe, 00000009.00000003.3119803218.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3092499477.0000000001284000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000122B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029437490.0000000001283000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122847906.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.0000000001284000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122658789.000000000122D000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3087755714.000000000383D000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3137538281.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.0000000001284000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3134231707.000000000122E000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3006552725.0000000001283000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3116794521.000000000383D000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3047195115.000000000382F000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3047775117.0000000003832000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.comD	3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://treehoneyi.click/=lg7	e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://grannyejh.lat:443/apical	128703c003.exe, 00000017.00000003.3368738714.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3334478529.0000000001679000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/apiT	a2236cc5aa.exe, 00000009.00000003.3119803218.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3094940649.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3122847906.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3137538281.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.datacontract.org/	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000D.00000002.2914223441.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.datacontract.org/2004/07/	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/api&	e565baa4b6.exe, 0000000A.00000002.3285986121.0000000000815000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3254207262.0000000000815000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/u	e565baa4b6.exe, 0000000A.00000003.3162109459.0000000005402000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php)	8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	false	high
https://t.me/k04aelm0nk3Mozilla/5.0	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	false	high
https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe	3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/r	e565baa4b6.exe, 0000000A.00000003.3255326461.0000000005406000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://ocsp.rootca1.amazontrust.com0:	a2236cc5aa.exe, 00000009.00000003.2973397042.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133975514.0000000005429000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3272707653.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	false	high
https://pancakedipyps.click/apiH	a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000002.3135914108.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click:443/apiefault-release/key4.dbPK	a2236cc5aa.exe, 00000009.00000002.3133800466.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3092499477.0000000001212000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3029437490.0000000001212000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.ecosia.org/newtab/	a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	128703c003.exe, 00000017.00000003.3281980626.0000000006109000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/;.	e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://treehoneyi.click/	e565baa4b6.exe, 0000000A.00000003.3132201109.00000000053FC000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133060846.0000000005405000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3137766063.0000000005406000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3316209595.0000000005407000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3106309298.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3103245205.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3316055734.0000000005401000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3133607214.0000000005406000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3108132250.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3132201109.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3132555502.0000000005402000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3106075883.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3255326461.0000000005406000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3132410630.00000000053FC000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3190290068.0000000005405000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3162109459.0000000005402000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005406000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.w3.oh	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810059E000.00000004.00000800.00020000.00000000.sdmp, 9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.000001810026F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://defaultcontainer/StoreInstaller;component/Resources/app.Light.ico	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://treehoneyi.click/api	e565baa4b6.exe, 0000000A.00000003.3254207262.0000000000815000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3190222323.0000000000872000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000002.3288044439.000000000087B000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3253053792.0000000000863000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.micro	e565baa4b6.exe, 0000000A.00000003.3253053792.000000000085F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2913135607.0000000002D49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2972792900.0000000007FD2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com	3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://foo/Resources/StoreLogo.Light.png	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://treehoneyi.click/apiA	e565baa4b6.exe, 0000000A.00000002.3287096139.0000000000863000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.2914223441.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2944804994.0000000004696000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000000.3043796968.0000000000423000.00000008.00000001.01000000.00000010.sdmp	false	high
http://raw.githubusercontent.com	3494904393.exe, 0000000B.00000002.3054106984.000000000296F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	a2236cc5aa.exe, 00000009.00000003.2976264747.0000000003848000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://frostman.shop/	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	e565baa4b6.exe, 0000000A.00000003.3139904879.0000000005402000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe	128703c003.exe, 00000017.00000003.3659903833.0000000001711000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpM	8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false	high
https://treehoneyi.click/apiZz	e565baa4b6.exe, 0000000A.00000003.3167500325.0000000000879000.00000004.00000020.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3166630569.0000000000874000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/pi	a2236cc5aa.exe, 00000009.00000003.3092499477.000000000128B000.00000004.00000020.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.3119803218.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://grannyejh.lat/u	128703c003.exe, 00000012.00000003.3011604086.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000012.00000002.3012509947.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.sectigo.com0	a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://grannyejh.lat/apiM	128703c003.exe, 00000017.00000003.3409861563.0000000005E73000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://web.telegram.org	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3068983043.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpa	8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false	high
https://frostman.shop/CA	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135615248.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3135498444.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3186628408.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3217460392.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3111755973.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3159345987.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com	3494904393.exe, 0000000B.00000002.3054106984.00000000028CE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/7	8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false	high
https://grannyejh.lat/p	128703c003.exe, 00000017.00000003.3168584611.0000000001682000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3212635855.0000000005E58000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	128703c003.exe, 00000017.00000003.3287089252.0000000005EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000010.00000002.2955040856.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://frostman.shop/w	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3257497509.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3391279863.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	a2236cc5aa.exe, 00000009.00000003.2810920560.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2810998044.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, a2236cc5aa.exe, 00000009.00000003.2811106417.00000000037E6000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007424069.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007803937.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, e565baa4b6.exe, 0000000A.00000003.3007230259.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, 63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3645264390.000000000374C000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3427026577.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3171774719.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172070009.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3172606078.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	false	high
http://foo/bar/resources/storelogo.light.png	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181002F5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	a2236cc5aa.exe, 00000007.00000002.2763394812.000000000099F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	8a13e339a3.exe, 00000015.00000003.3429758365.0000000001381000.00000004.00000020.00020000.00000000.sdmp, 8a13e339a3.exe, 00000015.00000003.3429758365.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phps	8a13e339a3.exe, 00000015.00000003.3429013238.0000000001394000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/H	128703c003.exe, 00000017.00000003.3659903833.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3666383879.0000000001702000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://frostman.shop/z	63506cf0a7384158900a9c4410789dbd.exe, 00000013.00000003.3651769649.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://foo/bar/resources/app.light.ico	9c439e52050a49e0875bf199b254f370.exe, 00000014.00000002.3127340552.00000181004BB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://grannyejh.lat/apit	128703c003.exe, 00000012.00000002.3012272539.000000000099E000.00000004.00000020.00020000.00000000.sdmp, 128703c003.exe, 00000017.00000003.3168584611.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.228	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
116.203.12.114	unknown	Germany	24940	HETZNER-ASDE	false
149.154.167.99	unknown	United Kingdom	62041	TELEGRAMRU	false
23.218.208.109	unknown	United States	6453	AS6453US	false
142.250.181.132	unknown	United States	15169	GOOGLEUS	false
142.250.181.110	unknown	United States	15169	GOOGLEUS	false
52.40.120.141	unknown	United States	16509	AMAZON-02US	false
34.117.188.166	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.67.209.202	unknown	United States	13335	CLOUDFLARENETUS	false
64.233.164.84	unknown	United States	15169	GOOGLEUS	false
185.199.109.133	unknown	Netherlands	54113	FASTLYUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.67.180.113	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.64.80	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.233.83.145	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.221.82	unknown	United States	15169	GOOGLEUS	false
35.244.181.201	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.3	unknown	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
35.190.72.216	unknown	United States	15169	GOOGLEUS	false
34.160.144.191	unknown	United States	2686	ATGS-MMD-ASUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
23.37.188.210	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578628
Start date and time:	2024-12-20 00:09:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@149/127@0/31
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Execution Graph export aborted for target a2236cc5aa.exe, PID 5256 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:10:16	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
00:11:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 128703c003.exe C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
00:11:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 128703c003.exe C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
00:11:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8a13e339a3.exe C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
00:12:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7ccdd68f3b.exe C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe
00:12:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2fc1eb1411.exe C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe
00:12:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8a13e339a3.exe C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
00:12:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7ccdd68f3b.exe C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe
00:12:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2fc1eb1411.exe C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe
00:13:00	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
00:14:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8d966c471d.exe C:\Users\user\AppData\Local\Temp\1017995001\8d966c471d.exe
00:14:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9c5dc2c478.exe C:\Users\user\AppData\Local\Temp\1017996001\9c5dc2c478.exe
00:14:22	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
00:14:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4e48e9ad99.exe C:\Users\user\AppData\Local\Temp\1017997001\4e48e9ad99.exe
00:14:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ab2f510d23.exe C:\Users\user\AppData\Local\Temp\1017998001\ab2f510d23.exe
00:14:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8d966c471d.exe C:\Users\user\AppData\Local\Temp\1017995001\8d966c471d.exe
00:14:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9c5dc2c478.exe C:\Users\user\AppData\Local\Temp\1017996001\9c5dc2c478.exe
00:15:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4e48e9ad99.exe C:\Users\user\AppData\Local\Temp\1017997001\4e48e9ad99.exe
00:15:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ab2f510d23.exe C:\Users\user\AppData\Local\Temp\1017998001\ab2f510d23.exe
18:11:02	API Interceptor	15066916x Sleep call for process: skotes.exe modified
18:11:17	API Interceptor	8x Sleep call for process: a2236cc5aa.exe modified
18:11:24	API Interceptor	67x Sleep call for process: e565baa4b6.exe modified
18:11:29	API Interceptor	20x Sleep call for process: powershell.exe modified
18:11:36	API Interceptor	527x Sleep call for process: 128703c003.exe modified
18:11:36	API Interceptor	60x Sleep call for process: 3494904393.exe modified
18:11:45	API Interceptor	3x Sleep call for process: svchost.exe modified
18:12:08	API Interceptor	91698x Sleep call for process: 8a13e339a3.exe modified
18:12:19	API Interceptor	1x Sleep call for process: ebfedd813b.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
116.203.12.114	Setup.msi	Get hash	malicious	Vidar	Browse
	69633f.msi	Get hash	malicious	Vidar	Browse
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	149.154.167.99
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
HETZNER-ASDE	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	167.233.43.233
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	5.9.64.77
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	94.130.191.168
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	213.239.239.164
	2.elf	Get hash	malicious	Unknown	Browse	168.119.31.126
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	136.243.197.146
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.9.225.47
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	94.130.191.168
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	94.130.191.168
	https://img10.reactor.cc/pics/post/full/Sakimichan-artist-Iono-(Pokemon)-Pok%c3%a9mon-7823638.jpeg	Get hash	malicious	HTMLPhisher	Browse	195.201.152.110
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	185.215.113.64
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.215.113.43
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	1So9BcQi1J.exe	Get hash	malicious	Stealc, Vidar	Browse
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse

Created / dropped Files

C:\ProgramData\BKFIJJEG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\26XT0Z

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	12666
Entropy (8bit):	5.47449330293569
Encrypted:	false
SSDEEP:	192:mETv4bvarnPOeRnLYbBp6EkJ0aX+16SEXKvNVa5RHWNBw8dLSl:ZDeaJUsgcHEw00
MD5:	8598305FFEBC723063E9E66223CC8EF7
SHA1:	D8453CCF4A6732BEB735E7440F5E5A1D3250037A
SHA-256:	0565A1E58F9ABE06EADCC15730A5B31308097B2B639609DC60CF92B6173F9F83
SHA-512:	27356821DC9BC3C4FD1C4DC155CDF3FFD311105C785BE56C8B5F808073AD8033285942C679C76B3917B3ACBE001DF904EB78E52FC8EC3FC34801F48D47883792
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 4);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1734650012);..user_pref("app.update.lastUpdateTime.background-update-timer", 1734650012);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1734650012);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173465

C:\ProgramData\E3E3OPZUA1N7\58GD2V

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\9Z5X4W47G

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\AIMOHV

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\F3OHLN

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\OHL68YCT0

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\SJECBA

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\SRQ9HL

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\E3E3OPZUA1N7\VAIM7G

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651531897062716
Encrypted:	false
SSDEEP:	384:TY2qOB1nxCkMPSAELyKOMq+8yC8F/YfU5m+OlTLVumF:5q+n0JP9ELyKOMq+8y9/OwO
MD5:	C0DF2B635D24E4DEF5DE91983BA8E0DD
SHA1:	3F4C5852141857BEAA3E85450185A892D121CF24
SHA-256:	24FC73E4209742037A1CE3EE1D21EEED994A09EE40ED091F3252769187668F79
SHA-512:	E1B822320C58768671A1EFEAA6664D62242E74D522EB09F370686BC30D22ECBAC9F629330046616AD5277CE892BB00CE2111B70BA6692CB114270FBA20B185F7
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFHIDGIJKJKECBGDBGHDBKFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECFIEGDBKJKFIDHIECG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBGDHIIDAEBFHJJDBFIDGIJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJKEHCAKFBFHJKEHCF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	modified
Size (bytes):	11830
Entropy (8bit):	5.462869230447137
Encrypted:	false
SSDEEP:	192:YnPOeRnLYbBp63kJ0aX+H6SEXK5NVa5RHWNBw8d2Sl:CDeFJUascHEwD0
MD5:	A1A8FAC0125C7EE95206B26E8769E75D
SHA1:	0439342306BA7FB5A7465231FA6E40A5A3967854
SHA-256:	783A948152D9406B7E273D27BD5A7C1A382CD6E5E6661B403E7F5D72EE6923E6
SHA-512:	D6B3D84E0ABC4E05775CE9A76DBC1A0646BA02E245C0E7C3BD499BAD015B80BF639B5251684AB9335351B60E4F5C7AEF54FBED09FC295DE905E572A96E39E9A2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1734649954);..user_pref("app.up

C:\ProgramData\JKJDHDBKEBGHJJJJKEHD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFIEHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x95f5fb18, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6583976768541445
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:Zaza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	7A0ABB4147D12834439BB287FC247C66
SHA1:	3134AEA6B37224962343913EC008F6FC31FEE199
SHA-256:	3C36F20B1A04FF691191703EA4AE27BAE374C4AEF41F445085D78FEEA1A1076F
SHA-512:	507AB2085AECFF33311286BED769824A0A59E58BD797954C21A482744B9CBAD5F4C56FA4734DAAFE4C301C4F6A9C7A52DA42A6F1BC05419EC6A0E7AF3506A4E1
Malicious:	false
Preview:	....... ...............X\...;...{......................T.~..........\|..-....\|..h.\|..........\|..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................2......\|.....................u.....\|...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 1So9BcQi1J.exe, Detection: malicious, Browse Filename: Tii6ue74NB.exe, Detection: malicious, Browse Filename: AWrVzd6XpC.exe, Detection: malicious, Browse Filename: ZXVcgrmGRM.exe, Detection: malicious, Browse Filename: D2Cw8gWOXj.exe, Detection: malicious, Browse Filename: random.exe.7.exe, Detection: malicious, Browse Filename: random.exe.6.exe, Detection: malicious, Browse Filename: stealc_default2.exe, Detection: malicious, Browse Filename: V65xPrgEHH.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\9c439e52050a49e0875bf199b254f370.exe.log

Download File

Process:	C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	5.365271649872934
Encrypted:	false
SSDEEP:	96:iqbYqGSI6ou/fmOYqSqtzHeqKksvoqdqZ4UqqI9m1RWQvqh:iqbYqGcn/uHqXtzHeqKksvoqdqZrqqxQ
MD5:	5AE8E4F3A04541A6E49A025DC877C086
SHA1:	7369D60293F7DEEC11B8181B5E527148CE7F2F5F
SHA-256:	5262E4D29ECBC33479F0F64EC5F90AEC90055A3FC90DAAC8DDFAF7B30E5336B0
SHA-512:	FDDCB3BE9DF19ABD547A53BE3F6202DFBDBD94A362EC5D03ECC083846E75467C54682C769F41B2E99D95CD49F6F662D03B2A890FC764765EE975172088BB8F88
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2fc1eb1411.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3494904393.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ebfedd813b.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f1012a1-9a67-4dc7-95e7-af3cf3195a57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44628
Entropy (8bit):	6.095592488492354
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB9wu0hDO6vP6O39u1/JQ7lDkVacGoup1Xl3jVzXr2:z/Ps+wsI7ynED6XUuchu3VlXr4CRo1
MD5:	BC8182AB5613F6231F1A46FB7C3AF122
SHA1:	41FC537E5172284F24870F106F24EDFAA1D2A0C8
SHA-256:	E0A904EE76EB67671819B5234BB440E18C027622111D77B438A5DC22DB9D9EE2
SHA-512:	7DB06B278CE2267C971EF1F9CFD445566DAA64B7C90C314C069672B09F0EDAE8946691CD02E6C5A9A6FF883E652781C3A31E0B65F696B2ACFADA505E61C47F25
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5d5b2083-6644-40c1-aa28-403141127c74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090708692820131
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEo6utbz8hu3VlXr4CRo1
MD5:	8978E28B25E3B8A3ECA85411660FDA1C
SHA1:	3246E79E35E545F2705A8BB9249F28550BE7ADEB
SHA-256:	E31276FD7F8556A8440847F23ACA0351EC73BCBCD2F1BAD1FF33AB365B18E291
SHA-512:	3CE40725D3ED586C37CA8E337D55BBC867456DB248305F4FE3C137003856F03D82D8A50B6DBBAA6EACDCB63AF5FFB2A755D6416368FE3350CE0011DB4A980A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.0461987566804245
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKe/wBVP/Sh/JzvPWVcRVEVg3WWD54llt:o1ApdeaOwBVsJDu2ziy54/
MD5:	02782FAC29D38EA69C940C2449D80718
SHA1:	86A6D7B6E557423CA0599FA2D08B84423E8133E2
SHA-256:	AD698E12C3D7A76B1B1B6CA32F37B706F15440EC8FFBF7C8BF8CCDB418F2E36F
SHA-512:	C4279E8454F0266CFE47854F66F58C40850CD8C4F17BC4C00EFA925CF2F6B034B12DC9CF3CF5130F2F0A24B1AF0258BBF1123E785148B16D3D0256EE2F9BEF2C
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................X..<EE..r/y...................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090708692820131
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEo6utbz8hu3VlXr4CRo1
MD5:	8978E28B25E3B8A3ECA85411660FDA1C
SHA1:	3246E79E35E545F2705A8BB9249F28550BE7ADEB
SHA-256:	E31276FD7F8556A8440847F23ACA0351EC73BCBCD2F1BAD1FF33AB365B18E291
SHA-512:	3CE40725D3ED586C37CA8E337D55BBC867456DB248305F4FE3C137003856F03D82D8A50B6DBBAA6EACDCB63AF5FFB2A755D6416368FE3350CE0011DB4A980A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF54a9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090708692820131
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEo6utbz8hu3VlXr4CRo1
MD5:	8978E28B25E3B8A3ECA85411660FDA1C
SHA1:	3246E79E35E545F2705A8BB9249F28550BE7ADEB
SHA-256:	E31276FD7F8556A8440847F23ACA0351EC73BCBCD2F1BAD1FF33AB365B18E291
SHA-512:	3CE40725D3ED586C37CA8E337D55BBC867456DB248305F4FE3C137003856F03D82D8A50B6DBBAA6EACDCB63AF5FFB2A755D6416368FE3350CE0011DB4A980A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF54adb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090708692820131
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+Ptbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEo6utbz8hu3VlXr4CRo1
MD5:	8978E28B25E3B8A3ECA85411660FDA1C
SHA1:	3246E79E35E545F2705A8BB9249F28550BE7ADEB
SHA-256:	E31276FD7F8556A8440847F23ACA0351EC73BCBCD2F1BAD1FF33AB365B18E291
SHA-512:	3CE40725D3ED586C37CA8E337D55BBC867456DB248305F4FE3C137003856F03D82D8A50B6DBBAA6EACDCB63AF5FFB2A755D6416368FE3350CE0011DB4A980A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\abebfefb-e863-497e-8afd-43f86056dd1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44628
Entropy (8bit):	6.095592488492354
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB9wu0hDO6vP6O39u1/JQ7lDkVacGoup1Xl3jVzXr2:z/Ps+wsI7ynED6XUuchu3VlXr4CRo1
MD5:	BC8182AB5613F6231F1A46FB7C3AF122
SHA1:	41FC537E5172284F24870F106F24EDFAA1D2A0C8
SHA-256:	E0A904EE76EB67671819B5234BB440E18C027622111D77B438A5DC22DB9D9EE2
SHA-512:	7DB06B278CE2267C971EF1F9CFD445566DAA64B7C90C314C069672B09F0EDAE8946691CD02E6C5A9A6FF883E652781C3A31E0B65F696B2ACFADA505E61C47F25
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	5.300117352760911
Encrypted:	false
SSDEEP:	12:MVBX8QNJBiROpUHuguG7UqqbgxH1KYpm4k7OpUHu3:OBfNaoCHuTG7Uqi4H17dCHu3
MD5:	80FAC6FFC34385EF485EE3DC62C7F748
SHA1:	0F3214DD9654E067EA854E7DDCB4FE3CE3053CB5
SHA-256:	1B5859B9D01650B1877618F3B03F9564B32F7B1B809C5819265BB70BB13188C2
SHA-512:	42253C446E37C73326B6A81337B2DB73E18449E2FDC613A7E832CEA339B65298AB651A07E705585D994D29F1389FE608C19EBC3912774AB0EE8C5FCCE19F2D53
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/ABE5D14DCF6B3EE681038727AA795480",.. "faviconUrl": "https://assets.msn.com/statics/icons/favicon_newtabpage.png",.. "id": "ABE5D14DCF6B3EE681038727AA795480",.. "title": "New tab",.. "type": "page",.. "url": "edge://newtab/",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/ABE5D14DCF6B3EE681038727AA795480"..} ]..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817024
Entropy (8bit):	6.502583084865015
Encrypted:	false
SSDEEP:	49152:M7ElLg4wLHnisqQk6Oeq/s+RYoL+w3moQsKDURHr9:M7El07EQkdeqFRYCz3moQzDuL9
MD5:	27D1C23073BBF3BE2092A18AB4CF9818
SHA1:	CC101A86E9519506179C51B3FE675A52A701C6BE
SHA-256:	FBE50F1EE3463F3B76126739B438AF49EDD32FCE2B636F57A9741B1689160C8B
SHA-512:	AE692D5679119EA1E07832A2ABC2ACC3B58E76BF6BAA1CD43CB0AF30EA0AAC684DB9C53B0CE8AFCCAEC5FDFFCBED0254FD4F8D7C20B32C00EB3F53C839FBED5A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....\.+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...ehjhpitf........n..h..............@...ijjaccto. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	810496
Entropy (8bit):	7.808597434734726
Encrypted:	false
SSDEEP:	24576:grtEhokkSG4bPWQ8C8z3zcB49CNPWQ8C8z3zcB49Cx:grGhokkSG4bPWQv8z3BYNPWQv8z3BYx
MD5:	E8AF4D0D0B47AC68D762B7F288AE8E6E
SHA1:	1D65F31526CC20AB41D6B1625D6674D7F13E326C
SHA-256:	B83449768E7AF68867C8BC42B19FF012722D88EA66AEF69DF48661E63E0EB15E
SHA-512:	80FAD90314FF639F538A72C5E4CA2BF9AE52B9309CAA7CD6F87D61791505BB3612B7F3190AB9B67348C5D71F4D29BB9D101E3F66D525EB9B5E2060A10B2D187A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....^g.........."......f........................@.......................................@.....................................P....p..........................x...........................x.......................`...\|............................text...md.......f.................. ..`.rdata..............n..............@..@.data...,%... ......................@....CODE........P....... .............. ..`.tls.........`.......0..............@....rsrc........p.......2..............@..@.reloc..x............4..............@..B.bss.................R..............@....bss.........0......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.702836450851498
Encrypted:	false
SSDEEP:	24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aLpAZqZJ:5TvC/MTQYxsWR7aLmZqZ
MD5:	134E8ED7546996583F248F49C87D99A2
SHA1:	7998F64C61662137E5ED3F0DBBE88DAC493AD95C
SHA-256:	99EAD08700A6DB4F3D6FBC4DD6E9435A32E4D0BF168E241C46E34CEF8620CECD
SHA-512:	CC08EFC2721FD49E971AF55F3ED05114B9D9FE3EE51ECC7EF7ED2F9299A8A46E7FBFEB9CBAF6388079F00098C8B101D73B760FE843A70A8F0A63910DF75E4D0A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....dg..........".................w.............@..........................0......Bx....@...@.......@.....................d...\|....@...b.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....b...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4470784
Entropy (8bit):	7.98631408508455
Encrypted:	false
SSDEEP:	98304:n2HUae1lrFMtxO8BIfxMw4Azf21lpvXpnmD7ElhvpJdOXyDvTn:7/MDO9fxMSC1lpvXikkkvTn
MD5:	A662856DF913178C0E54B194AFE4DD2B
SHA1:	5CC4318E946E1A6F9625019D9E5150E480AEB2BF
SHA-256:	F7B0783FDB5C0E335976B3F4BAA43D8E76925AE478F341200C9474F1126ED7CB
SHA-512:	0E87B88F79B1F2B68EA907E9975979F587EC5C0451001B5404E4CC44EBC2E1072AE2F9B297E2A44A51D458622F076A2512265C8F48FE9BCD05626D17B2ABC9DE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...`.......pH...@.................................O.D...@... ............................._pt.s....`t......................N...............................M...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... . 9...t......`(.............@...pgbzfndf.............b(.............@...xfbmxldi.....P........D.............@....taggant.0...`..."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800704
Entropy (8bit):	7.947640823884506
Encrypted:	false
SSDEEP:	49152:Zl78yuxW3WLrcjKsLhJahTiN5yhwNPb6jQVBT5q:Zu/xWGQKsLbSaIiNjSAW
MD5:	3647AF905F92B479113300608444F101
SHA1:	84E4D4C7BEDA95176AD3DDFCF10169F7DA8E2BEA
SHA-256:	6EB4D74F0C7CF5780099F4DA5EA6F57C0648AD552888F7ACCF0C5251AE27BCAC
SHA-512:	4CDEDDE69EC6D8EC92FFAF2CE4E5CC6ED39A954672D88F548ED8F7AD80F44BF875725EBF8593E1440CC939860E0E3F09E4E13092FB59F4A5A8600B8CE5167BB7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0G...........@..........................`G.....0.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..(..@.......\..............@...ijtgtnqw..... .......^..............@...jumutqrp..... G......T..............@....taggant.0...0G.."...X..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928704
Entropy (8bit):	7.94324154252622
Encrypted:	false
SSDEEP:	49152:rTMq5MIQ0Tqibh61R5agdp707srnnouWcbxdt+ogki:nMq5M3iwR5agdiSnnoybbt+J
MD5:	4E341A5E65522DC7AD83BAB52F3E60F8
SHA1:	D3A1D76710068D38CD35ED908C0677263F5D97E9
SHA-256:	9AFAD313FDB3A41015EC415280986B4D596B1DC07BCC46B49F5BEE6FCF5FB54C
SHA-512:	27C41EDDED8E29F87BE28BB93E86AE26129F28A63134235FA38493909BEF08B2559B0DA1BD03C4E2856B7CC6DBD2174650E7E3634F015E9F600F25BAB4A4D3AC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@.......p............@.........................................................................[.A.o.....@.....................................................\...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .P)...A.....................@...bpztmzrt......j..v..................@...skyqimte.....`.......H..............@....taggant.0...p..."...L..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[5].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Download File

Process:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	5.395971367557378
Encrypted:	false
SSDEEP:	96:6NnCmHCNNnC/YbCMNnCKq89CK/NnCRdgECINnCzivioCzijNnC85IdDC8gNnCUwx:6NGNJNpqS/NijNyivi5ijNnidLgNFtNe
MD5:	B1ACB08A4F1ADBAB65532754B3ED4F8C
SHA1:	115E3123DC4DA726E34295AD9FFB3F8288A55D31
SHA-256:	64D532D967DC4ABA8AE313D459DF5D4B23DCB246D6CB603D028D81545C492829
SHA-512:	81AA9E021A0B3CA905D60EE3727C9B1A3FF00BE3A208E3583358FFB1607768F51CBD62380E10D14CD1A7559FB873BE4F26DD17ADC30B3B92B3AA2FD03F197E13
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/13BE5BE9622C4CFC13C070C93BF80D57",.. "id": "13BE5BE9622C4CFC13C070C93BF80D57",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/13BE5BE9622C4CFC13C070C93BF80D57"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/E78C396DC83019CAE2FCA9B233CAF477",.. "id": "E78C396DC83019CAE2FCA9B233CAF477",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/E78C396DC83019CAE2FCA9B233CAF477"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2893824
Entropy (8bit):	6.467685485178008
Encrypted:	false
SSDEEP:	24576:wCbHPu0xIK60PjVzm+w2flaokYLK614FcXh5r6rSSW4OWHiHdq2VDaQJvISnxw3x:w8KwPjURY5sSSW4pi9qwDaxSnIiUN
MD5:	2854309DFD78A64E325E67004B94ADDF
SHA1:	78CF19390D1511E03139893C33D11BD2B7BE5D99
SHA-256:	CA61E922A2E723631B64B8D73B4AF5BC968C5BB29EC1073C2060C11B79F7FA8D
SHA-512:	FDE2202160B9CFE3EB595D6B6A481B2A8122DA0EF9B7208DE741D2449A20B4E0BBE11F9CDB247A95C567CC40426FFFF0741557F636159A468E9167308EFB0DDF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`O...........@...........................O......y,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...uqvrrapw.....$.....\|..............@...blfuhhpc.....PO.......,.............@....taggant.0...`O.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1990144
Entropy (8bit):	7.9520955615384645
Encrypted:	false
SSDEEP:	49152:Da3bNDzsqksE47b1MkhCia2nmiDFikFdlZG0:e3bNfkn4FKia1QL
MD5:	2DA5C2BBE3A73ECEA269706891E912FA
SHA1:	CEEE3AF9DC0A4903B2A2C708E3B33A70A417215B
SHA-256:	FA2A0AA5F11E6C367D0EA66117DCF31086630222D1C2AF5B46A92B7BFE1089F7
SHA-512:	AE52660BECA7E8A5926C690ED19142E90E688D0DB871C1362D9E72FA40613E786340AFEDBECFF2C5EA4BB68967E5917BC2C4D57DCADF44C69CE98F38102BEF19
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................L......g....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...xmsxfkky......1......X..............@...uydpyjdy......K......6..............@....taggant.0....K.."...<..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4455936
Entropy (8bit):	7.985009488298196
Encrypted:	false
SSDEEP:	98304:i5Vhq3obBjDB2C53R1xQuyJul6y09/LuI7/wH8yO1g:8SobpDRB1XyJul6y04W/wH8y+
MD5:	8664A5A6E958F985735B8A17171550BC
SHA1:	3DEB8BFCDC32DDF9A678F44C59AA70E3A7F5BB5F
SHA-256:	FFCC7288342A28C0580BEA142951BF4AC33A3F391D8F9323F9E74293D2817E82
SHA-512:	ADC1C9BC3AF3A39B066A9231EF6BD9119D48DFF41A4E5BFAC695C40A5D2B9E5E9F4EB6E4779408CD7F22FE0E7E5697D7FA314778864FD13BB321DB3F8D0514B0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@...................................D...@... ............................._.a.s.....a......................p...............................p...................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... .P8...a......R(.............@...biyvevdc............T(.............@...aogmlwgx..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPFED7C.tmp

Download File

Process:	C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36016
Entropy (8bit):	7.983926499838966
Encrypted:	false
SSDEEP:	768:tCJpXgIqzFJfREOAev/Gp0/XlxqHNxGny8mewtOodJCDz3E:oJ9WR3Aev/20/VxqHNTBfd0D4
MD5:	A293ABF92B1DE52DF77CBCA7C5D98DF2
SHA1:	DD342D01A0AFA093092EB544D6D7AD50EFAC6E96
SHA-256:	FAB35B6046CF4E853CB7FE432850DD29A459576E3C21D8B29B0B06211612B40E
SHA-512:	C21186913AE669BAB9E6BC5BAFD8EDCA2A89894CF6B86E85D7BC9DD103BF064923201A06E8C7EFDF0ACFF5E3BF0C9CE8D9F0A726C1E4AC8D411BEAD5B3E7ED8D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...,...,.....y}.u....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.381368395106955
Encrypted:	false
SSDEEP:	48:JWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//YPUyus:JLHxvIIwLgZ2KRHWLOugQs
MD5:	3E1B417513D6CFCB3689E05C77D98781
SHA1:	CDA9250210A8C92349CF3A1D509260EBA54E050F
SHA-256:	7E86FDBEF5229AD1EA05F984190B0444A129B058E49E492000ECDE7A9E03126D
SHA-512:	9A595ED4D89E60EFE9E4E9A2FBB0141B1E0FF6561CB2988DE57C51F211BCDA8BFF243A3E8BB926D723847771C08689E91937ABD06CD076421C21B0853AC93AA2
Malicious:	false
Reputation:	unknown
Preview:	@...e.................................:..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800704
Entropy (8bit):	7.947640823884506
Encrypted:	false
SSDEEP:	49152:Zl78yuxW3WLrcjKsLhJahTiN5yhwNPb6jQVBT5q:Zu/xWGQKsLbSaIiNjSAW
MD5:	3647AF905F92B479113300608444F101
SHA1:	84E4D4C7BEDA95176AD3DDFCF10169F7DA8E2BEA
SHA-256:	6EB4D74F0C7CF5780099F4DA5EA6F57C0648AD552888F7ACCF0C5251AE27BCAC
SHA-512:	4CDEDDE69EC6D8EC92FFAF2CE4E5CC6ED39A954672D88F548ED8F7AD80F44BF875725EBF8593E1440CC939860E0E3F09E4E13092FB59F4A5A8600B8CE5167BB7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0G...........@..........................`G.....0.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..(..@.......\..............@...ijtgtnqw..... .......^..............@...jumutqrp..... G......T..............@....taggant.0...0G.."...X..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2893824
Entropy (8bit):	6.467685485178008
Encrypted:	false
SSDEEP:	24576:wCbHPu0xIK60PjVzm+w2flaokYLK614FcXh5r6rSSW4OWHiHdq2VDaQJvISnxw3x:w8KwPjURY5sSSW4pi9qwDaxSnIiUN
MD5:	2854309DFD78A64E325E67004B94ADDF
SHA1:	78CF19390D1511E03139893C33D11BD2B7BE5D99
SHA-256:	CA61E922A2E723631B64B8D73B4AF5BC968C5BB29EC1073C2060C11B79F7FA8D
SHA-512:	FDE2202160B9CFE3EB595D6B6A481B2A8122DA0EF9B7208DE741D2449A20B4E0BBE11F9CDB247A95C567CC40426FFFF0741557F636159A468E9167308EFB0DDF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`O...........@...........................O......y,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...uqvrrapw.....$.....\|..............@...blfuhhpc.....PO.......,.............@....taggant.0...`O.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.702836450851498
Encrypted:	false
SSDEEP:	24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aLpAZqZJ:5TvC/MTQYxsWR7aLmZqZ
MD5:	134E8ED7546996583F248F49C87D99A2
SHA1:	7998F64C61662137E5ED3F0DBBE88DAC493AD95C
SHA-256:	99EAD08700A6DB4F3D6FBC4DD6E9435A32E4D0BF168E241C46E34CEF8620CECD
SHA-512:	CC08EFC2721FD49E971AF55F3ED05114B9D9FE3EE51ECC7EF7ED2F9299A8A46E7FBFEB9CBAF6388079F00098C8B101D73B760FE843A70A8F0A63910DF75E4D0A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....dg..........".................w.............@..........................0......Bx....@...@.......@.....................d...\|....@...b.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....b...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817024
Entropy (8bit):	6.502583084865015
Encrypted:	false
SSDEEP:	49152:M7ElLg4wLHnisqQk6Oeq/s+RYoL+w3moQsKDURHr9:M7El07EQkdeqFRYCz3moQzDuL9
MD5:	27D1C23073BBF3BE2092A18AB4CF9818
SHA1:	CC101A86E9519506179C51B3FE675A52A701C6BE
SHA-256:	FBE50F1EE3463F3B76126739B438AF49EDD32FCE2B636F57A9741B1689160C8B
SHA-512:	AE692D5679119EA1E07832A2ABC2ACC3B58E76BF6BAA1CD43CB0AF30EA0AAC684DB9C53B0CE8AFCCAEC5FDFFCBED0254FD4F8D7C20B32C00EB3F53C839FBED5A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....\.+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...ehjhpitf........n..h..............@...ijjaccto. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017983001\f71e300ff9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1671168
Entropy (8bit):	7.957359010004932
Encrypted:	false
SSDEEP:	49152:rTMq5MIQ0Tqibh61R5agdp707srnnouWc0:nMq5M3iwR5agdiSnnoy0
MD5:	A7AB8D3ECF75E852325062CA2BC27972
SHA1:	174ABC8DBC1E7134895E4C8EE66E217AF2D1C7EE
SHA-256:	B5CCB12F3729D8BC608D78A4689624344A7A4F57850A3989E47AFDA32735174B
SHA-512:	FC1A8560EFE50EE99CDB94F81DE9A4187C380D6AA0E41D770A95BDE057011657ECCC8AE9866E27534F16C4F839A3200802260F6E3F1051AD120C2A0E8257083C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@.......p............@.........................................................................[.A.o.....@.....................................................\...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .P)...A.....................@...bpztmzrt......j..v..................@...skyqimte.....`.......H..............@....taggant.0...p..."...L..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1017985001\1e467b8b46.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017986001\5dfec4fe99.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1990144
Entropy (8bit):	7.9520955615384645
Encrypted:	false
SSDEEP:	49152:Da3bNDzsqksE47b1MkhCia2nmiDFikFdlZG0:e3bNfkn4FKia1QL
MD5:	2DA5C2BBE3A73ECEA269706891E912FA
SHA1:	CEEE3AF9DC0A4903B2A2C708E3B33A70A417215B
SHA-256:	FA2A0AA5F11E6C367D0EA66117DCF31086630222D1C2AF5B46A92B7BFE1089F7
SHA-512:	AE52660BECA7E8A5926C690ED19142E90E688D0DB871C1362D9E72FA40613E786340AFEDBECFF2C5EA4BB68967E5917BC2C4D57DCADF44C69CE98F38102BEF19
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................L......g....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...xmsxfkky......1......X..............@...uydpyjdy......K......6..............@....taggant.0....K.."...<..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017987001\7bbff7a3a2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017988001\2dc416cfa5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017989001\4c7aea0d0a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4455936
Entropy (8bit):	7.985009488298196
Encrypted:	false
SSDEEP:	98304:i5Vhq3obBjDB2C53R1xQuyJul6y09/LuI7/wH8yO1g:8SobpDRB1XyJul6y04W/wH8y+
MD5:	8664A5A6E958F985735B8A17171550BC
SHA1:	3DEB8BFCDC32DDF9A678F44C59AA70E3A7F5BB5F
SHA-256:	FFCC7288342A28C0580BEA142951BF4AC33A3F391D8F9323F9E74293D2817E82
SHA-512:	ADC1C9BC3AF3A39B066A9231EF6BD9119D48DFF41A4E5BFAC695C40A5D2B9E5E9F4EB6E4779408CD7F22FE0E7E5697D7FA314778864FD13BB321DB3F8D0514B0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@...................................D...@... ............................._.a.s.....a......................p...............................p...................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... .P8...a......R(.............@...biyvevdc............T(.............@...aogmlwgx..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1017990001\101d940598.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Temp\1017991001\617d9fb7ad.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4470784
Entropy (8bit):	7.98631408508455
Encrypted:	false
SSDEEP:	98304:n2HUae1lrFMtxO8BIfxMw4Azf21lpvXpnmD7ElhvpJdOXyDvTn:7/MDO9fxMSC1lpvXikkkvTn
MD5:	A662856DF913178C0E54B194AFE4DD2B
SHA1:	5CC4318E946E1A6F9625019D9E5150E480AEB2BF
SHA-256:	F7B0783FDB5C0E335976B3F4BAA43D8E76925AE478F341200C9474F1126ED7CB
SHA-512:	0E87B88F79B1F2B68EA907E9975979F587EC5C0451001B5404E4CC44EBC2E1072AE2F9B297E2A44A51D458622F076A2512265C8F48FE9BCD05626D17B2ABC9DE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...`.......pH...@.................................O.D...@... ............................._pt.s....`t......................N...............................M...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... . 9...t......`(.............@...pgbzfndf.............b(.............@...xfbmxldi.....P........D.............@....taggant.0...`..."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017992001\e7bd366d99.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	810496
Entropy (8bit):	7.808597434734726
Encrypted:	false
SSDEEP:	24576:grtEhokkSG4bPWQ8C8z3zcB49CNPWQ8C8z3zcB49Cx:grGhokkSG4bPWQv8z3BYNPWQv8z3BYx
MD5:	E8AF4D0D0B47AC68D762B7F288AE8E6E
SHA1:	1D65F31526CC20AB41D6B1625D6674D7F13E326C
SHA-256:	B83449768E7AF68867C8BC42B19FF012722D88EA66AEF69DF48661E63E0EB15E
SHA-512:	80FAD90314FF639F538A72C5E4CA2BF9AE52B9309CAA7CD6F87D61791505BB3612B7F3190AB9B67348C5D71F4D29BB9D101E3F66D525EB9B5E2060A10B2D187A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....^g.........."......f........................@.......................................@.....................................P....p..........................x...........................x.......................`...\|............................text...md.......f.................. ..`.rdata..............n..............@..@.data...,%... ......................@....CODE........P....... .............. ..`.tls.........`.......0..............@....rsrc........p.......2..............@..@.reloc..x............4..............@..B.bss.................R..............@....bss.........0......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017993001\718f24a5dc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017994001\98679d2b4b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017995001\8d966c471d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800704
Entropy (8bit):	7.947640823884506
Encrypted:	false
SSDEEP:	49152:Zl78yuxW3WLrcjKsLhJahTiN5yhwNPb6jQVBT5q:Zu/xWGQKsLbSaIiNjSAW
MD5:	3647AF905F92B479113300608444F101
SHA1:	84E4D4C7BEDA95176AD3DDFCF10169F7DA8E2BEA
SHA-256:	6EB4D74F0C7CF5780099F4DA5EA6F57C0648AD552888F7ACCF0C5251AE27BCAC
SHA-512:	4CDEDDE69EC6D8EC92FFAF2CE4E5CC6ED39A954672D88F548ED8F7AD80F44BF875725EBF8593E1440CC939860E0E3F09E4E13092FB59F4A5A8600B8CE5167BB7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0G...........@..........................`G.....0.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..(..@.......\..............@...ijtgtnqw..... .......^..............@...jumutqrp..... G......T..............@....taggant.0...0G.."...X..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017996001\9c5dc2c478.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2893824
Entropy (8bit):	6.467685485178008
Encrypted:	false
SSDEEP:	24576:wCbHPu0xIK60PjVzm+w2flaokYLK614FcXh5r6rSSW4OWHiHdq2VDaQJvISnxw3x:w8KwPjURY5sSSW4pi9qwDaxSnIiUN
MD5:	2854309DFD78A64E325E67004B94ADDF
SHA1:	78CF19390D1511E03139893C33D11BD2B7BE5D99
SHA-256:	CA61E922A2E723631B64B8D73B4AF5BC968C5BB29EC1073C2060C11B79F7FA8D
SHA-512:	FDE2202160B9CFE3EB595D6B6A481B2A8122DA0EF9B7208DE741D2449A20B4E0BBE11F9CDB247A95C567CC40426FFFF0741557F636159A468E9167308EFB0DDF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`O...........@...........................O......y,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...uqvrrapw.....$.....\|..............@...blfuhhpc.....PO.......,.............@....taggant.0...`O.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017997001\4e48e9ad99.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.702836450851498
Encrypted:	false
SSDEEP:	24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aLpAZqZJ:5TvC/MTQYxsWR7aLmZqZ
MD5:	134E8ED7546996583F248F49C87D99A2
SHA1:	7998F64C61662137E5ED3F0DBBE88DAC493AD95C
SHA-256:	99EAD08700A6DB4F3D6FBC4DD6E9435A32E4D0BF168E241C46E34CEF8620CECD
SHA-512:	CC08EFC2721FD49E971AF55F3ED05114B9D9FE3EE51ECC7EF7ED2F9299A8A46E7FBFEB9CBAF6388079F00098C8B101D73B760FE843A70A8F0A63910DF75E4D0A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....dg..........".................w.............@..........................0......Bx....@...@.......@.....................d...\|....@...b.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....b...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017998001\ab2f510d23.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817024
Entropy (8bit):	6.502583084865015
Encrypted:	false
SSDEEP:	49152:M7ElLg4wLHnisqQk6Oeq/s+RYoL+w3moQsKDURHr9:M7El07EQkdeqFRYCz3moQzDuL9
MD5:	27D1C23073BBF3BE2092A18AB4CF9818
SHA1:	CC101A86E9519506179C51B3FE675A52A701C6BE
SHA-256:	FBE50F1EE3463F3B76126739B438AF49EDD32FCE2B636F57A9741B1689160C8B
SHA-512:	AE692D5679119EA1E07832A2ABC2ACC3B58E76BF6BAA1CD43CB0AF30EA0AAC684DB9C53B0CE8AFCCAEC5FDFFCBED0254FD4F8D7C20B32C00EB3F53C839FBED5A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....\.+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...ehjhpitf........n..h..............@...ijjaccto. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017999001\daaacc90a2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928704
Entropy (8bit):	7.94324154252622
Encrypted:	false
SSDEEP:	49152:rTMq5MIQ0Tqibh61R5agdp707srnnouWcbxdt+ogki:nMq5M3iwR5agdiSnnoybbt+J
MD5:	4E341A5E65522DC7AD83BAB52F3E60F8
SHA1:	D3A1D76710068D38CD35ED908C0677263F5D97E9
SHA-256:	9AFAD313FDB3A41015EC415280986B4D596B1DC07BCC46B49F5BEE6FCF5FB54C
SHA-512:	27C41EDDED8E29F87BE28BB93E86AE26129F28A63134235FA38493909BEF08B2559B0DA1BD03C4E2856B7CC6DBD2174650E7E3634F015E9F600F25BAB4A4D3AC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@.......p............@.........................................................................[.A.o.....@.....................................................\...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .P)...A.....................@...bpztmzrt......j..v..................@...skyqimte.....`.......H..............@....taggant.0...p..."...L..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DFAWHTB6ZKNPCDBIS7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2893824
Entropy (8bit):	6.467685485178008
Encrypted:	false
SSDEEP:	24576:wCbHPu0xIK60PjVzm+w2flaokYLK614FcXh5r6rSSW4OWHiHdq2VDaQJvISnxw3x:w8KwPjURY5sSSW4pi9qwDaxSnIiUN
MD5:	2854309DFD78A64E325E67004B94ADDF
SHA1:	78CF19390D1511E03139893C33D11BD2B7BE5D99
SHA-256:	CA61E922A2E723631B64B8D73B4AF5BC968C5BB29EC1073C2060C11B79F7FA8D
SHA-512:	FDE2202160B9CFE3EB595D6B6A481B2A8122DA0EF9B7208DE741D2449A20B4E0BBE11F9CDB247A95C567CC40426FFFF0741557F636159A468E9167308EFB0DDF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`O...........@...........................O......y,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...uqvrrapw.....$.....\|..............@...blfuhhpc.....PO.......,.............@....taggant.0...`O.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RIZ8QT1S0BQ20WD7KBBS21.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2893824
Entropy (8bit):	6.467685485178008
Encrypted:	false
SSDEEP:	24576:wCbHPu0xIK60PjVzm+w2flaokYLK614FcXh5r6rSSW4OWHiHdq2VDaQJvISnxw3x:w8KwPjURY5sSSW4pi9qwDaxSnIiUN
MD5:	2854309DFD78A64E325E67004B94ADDF
SHA1:	78CF19390D1511E03139893C33D11BD2B7BE5D99
SHA-256:	CA61E922A2E723631B64B8D73B4AF5BC968C5BB29EC1073C2060C11B79F7FA8D
SHA-512:	FDE2202160B9CFE3EB595D6B6A481B2A8122DA0EF9B7208DE741D2449A20B4E0BBE11F9CDB247A95C567CC40426FFFF0741557F636159A468E9167308EFB0DDF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`O...........@...........................O......y,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...uqvrrapw.....$.....\|..............@...blfuhhpc.....PO.......,.............@....taggant.0...`O.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TYUE4E8K2GIAZ6KSY1ZAXK0WL48NIVF.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817024
Entropy (8bit):	6.502583084865015
Encrypted:	false
SSDEEP:	49152:M7ElLg4wLHnisqQk6Oeq/s+RYoL+w3moQsKDURHr9:M7El07EQkdeqFRYCz3moQzDuL9
MD5:	27D1C23073BBF3BE2092A18AB4CF9818
SHA1:	CC101A86E9519506179C51B3FE675A52A701C6BE
SHA-256:	FBE50F1EE3463F3B76126739B438AF49EDD32FCE2B636F57A9741B1689160C8B
SHA-512:	AE692D5679119EA1E07832A2ABC2ACC3B58E76BF6BAA1CD43CB0AF30EA0AAC684DB9C53B0CE8AFCCAEC5FDFFCBED0254FD4F8D7C20B32C00EB3F53C839FBED5A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....\.+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...ehjhpitf........n..h..............@...ijjaccto. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpE6B3.tmp

Download File

Process:	C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe
File Type:	ASCII text, with very long lines (1136), with no line terminators
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.884313058724772
Encrypted:	false
SSDEEP:	24:QmeWUJxBiiAFaUlbJ2Hr1mI+Ic2iFerfnmj6BmKHnsZu:ZeX/ZkXgHr1m52iwrPvQInsZu
MD5:	A10F31FA140F2608FF150125F3687920
SHA1:	EC411CC7005AAA8E3775CF105FCD4E1239F8ED4B
SHA-256:	28C871238311D40287C51DC09AEE6510CAC5306329981777071600B1112286C6
SHA-512:	CF915FB34CD5ECFBD6B25171D6E0D3D09AF2597EDF29F9F24FA474685D4C5EC9BC742ADE9F29ABAC457DD645EE955B1914A635C90AF77C519D2ADA895E7ECF12
Malicious:	false
Reputation:	unknown
Preview:	MIIDUDCCAjigAwIBAgIQImsjBGfFTk6M7sZzNVcAwDANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExphdXRoLmluc3RhbGxlcnNlcnZpY2VzLmNvbTAeFw0yMzEwMjUyMzEzNDhaFw0yODEwMjUyMzIzNDhaMCUxIzAhBgNVBAMTGmF1dGguaW5zdGFsbGVyc2VydmljZXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnTHlqfx0MmiBSvhwkjmo2Y53B2ED6kyYgNgsSoX090DwL9g08Q2LnfEEFH+mif1Zv6jztT5QvWXjjroucDJQzZFBz/xbd1zilX80JFxD/8TIiKdmg73eXcrkSTsQUz97HwnpZbQDWbQJh/QxbvRIrJrcU2ADGsC5KBpRVXJ3t9m3TKNrfbAtKpPonso6+6GHvwUNTZUU9UgvDV3qGpDSniqumK3a1U9hphJJBb8us3o3538CM3tJAJ2w/bDGA/MOaTInkspZIQpecv16wkMWuLyHUxAaMDIO0tuIKxeIka0PaTAaZdw6BXofnNqwDD5JloOGm323JAR3pe+hJmSmQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUL8Xv6MyxPZ8/T+cj4fEkfSpVzqEwHQYDVR0OBBYEFC/F7+jMsT2fP0/nI+HxJH0qVc6hMA0GCSqGSIb3DQEBCwUAA4IBAQASgm1VIK9vC88LPaCv7qPEd2TUtRrOi/VG2HkcpmBIKGoDeFa41jzKpO25iMg4MQhlXuljIYMDch8YpZETcFvBXHzfCF7Rc+kl/K5tFd8kHGMItiPuwZV/BfvL9Wu4gY4g1skfRpiemP1gZvlc1fZlEoYDqAIzODkRyXOd2nsa7zt8iGTdNujZ8A/IyQzGNeqtmt+bpNvKojkB

C:\Users\user\AppData\Local\Temp\TmpE6D3.tmp

Download File

Process:	C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe
File Type:	ASCII text, with very long lines (1136), with no line terminators
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.884313058724772
Encrypted:	false
SSDEEP:	24:QmeWUJxBiiAFaUlbJ2Hr1mI+Ic2iFerfnmj6BmKHnsZu:ZeX/ZkXgHr1m52iwrPvQInsZu
MD5:	A10F31FA140F2608FF150125F3687920
SHA1:	EC411CC7005AAA8E3775CF105FCD4E1239F8ED4B
SHA-256:	28C871238311D40287C51DC09AEE6510CAC5306329981777071600B1112286C6
SHA-512:	CF915FB34CD5ECFBD6B25171D6E0D3D09AF2597EDF29F9F24FA474685D4C5EC9BC742ADE9F29ABAC457DD645EE955B1914A635C90AF77C519D2ADA895E7ECF12
Malicious:	false
Reputation:	unknown
Preview:	MIIDUDCCAjigAwIBAgIQImsjBGfFTk6M7sZzNVcAwDANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExphdXRoLmluc3RhbGxlcnNlcnZpY2VzLmNvbTAeFw0yMzEwMjUyMzEzNDhaFw0yODEwMjUyMzIzNDhaMCUxIzAhBgNVBAMTGmF1dGguaW5zdGFsbGVyc2VydmljZXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnTHlqfx0MmiBSvhwkjmo2Y53B2ED6kyYgNgsSoX090DwL9g08Q2LnfEEFH+mif1Zv6jztT5QvWXjjroucDJQzZFBz/xbd1zilX80JFxD/8TIiKdmg73eXcrkSTsQUz97HwnpZbQDWbQJh/QxbvRIrJrcU2ADGsC5KBpRVXJ3t9m3TKNrfbAtKpPonso6+6GHvwUNTZUU9UgvDV3qGpDSniqumK3a1U9hphJJBb8us3o3538CM3tJAJ2w/bDGA/MOaTInkspZIQpecv16wkMWuLyHUxAaMDIO0tuIKxeIka0PaTAaZdw6BXofnNqwDD5JloOGm323JAR3pe+hJmSmQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUL8Xv6MyxPZ8/T+cj4fEkfSpVzqEwHQYDVR0OBBYEFC/F7+jMsT2fP0/nI+HxJH0qVc6hMA0GCSqGSIb3DQEBCwUAA4IBAQASgm1VIK9vC88LPaCv7qPEd2TUtRrOi/VG2HkcpmBIKGoDeFa41jzKpO25iMg4MQhlXuljIYMDch8YpZETcFvBXHzfCF7Rc+kl/K5tFd8kHGMItiPuwZV/BfvL9Wu4gY4g1skfRpiemP1gZvlc1fZlEoYDqAIzODkRyXOd2nsa7zt8iGTdNujZ8A/IyQzGNeqtmt+bpNvKojkB

C:\Users\user\AppData\Local\Temp\WHQUF4KURLOTATA7WCHH.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817024
Entropy (8bit):	6.502583084865015
Encrypted:	false
SSDEEP:	49152:M7ElLg4wLHnisqQk6Oeq/s+RYoL+w3moQsKDURHr9:M7El07EQkdeqFRYCz3moQzDuL9
MD5:	27D1C23073BBF3BE2092A18AB4CF9818
SHA1:	CC101A86E9519506179C51B3FE675A52A701C6BE
SHA-256:	FBE50F1EE3463F3B76126739B438AF49EDD32FCE2B636F57A9741B1689160C8B
SHA-512:	AE692D5679119EA1E07832A2ABC2ACC3B58E76BF6BAA1CD43CB0AF30EA0AAC684DB9C53B0CE8AFCCAEC5FDFFCBED0254FD4F8D7C20B32C00EB3F53C839FBED5A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....\.+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...ehjhpitf........n..h..............@...ijjaccto. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0gywjwa.s22.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqvj11ct.bkh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ssxj0hle.i10.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxu4z54a.3pj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xg013ltv.nrh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmp0zwtr.trj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjaj1fu1.dh5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zkjzofzw.cz1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3023360
Entropy (8bit):	6.553754884227523
Encrypted:	false
SSDEEP:	49152:Zr515k/dk6Cw71eUMEdzK8Epe8C4IYilUBEhfqluQpq+K:5515k1klQ19LdzK8EpHICEc0aK
MD5:	8C724813B4468960543FCBCB4635F74F
SHA1:	23693D84C1441A3EDC77686C5A613F747CCFF8A6
SHA-256:	4CC2D946C5C43426F509193CB5BEE665F59F46C795C4DA045D3B5940D660E6D4
SHA-512:	C10F32547CD5A5921FA826EB11D437887B13B75ECD6D4A284288E12498E9D5406A779FB2FA2632D38412B6310DC53FCA530E59DC3B80DB76165431B2CF405CFA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................2......5....@.................................W...k.............................1.............................H.1..................................................... . ............................@....rsrc...............................@....idata ............................@...kfjqblss..+.......+.................@...vivpivkj......1.......-.............@....taggant.0....1.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 19 22:12:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979837070882284
Encrypted:	false
SSDEEP:	48:8oddRsTCmeHuidAKZdA19ehwiZUklqehXy+3:8oWzXoy
MD5:	B836CCDBDF5B7F72F92E88ED0E4371A4
SHA1:	81D950244D26592873DBCF9CACF98B416C7EF416
SHA-256:	9D11E6836E8C9317F62B13F89AD33FAC9355C976E4F9FACCAE48BDEBCD4E5F5C
SHA-512:	8ABB692E2337E4B2C970A388A2A235DD5BF249D3F9221AE27D4A85998317CCF19BDC04418EEB6D1E0298A4D21732485316847A9B3AE0B063115607B65D670C22
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....L.ikR..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yz.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}.X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 19 22:12:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9952848369970697
Encrypted:	false
SSDEEP:	48:8PCddRsTCmeHuidAKZdA1weh/iZUkAQkqehYy+2:8PCWzd9QNy
MD5:	E1A65AF5119B621DF80944980A4113E7
SHA1:	443593FEB1650E2E663B0B342CBC1118861FE67C
SHA-256:	3E4D322B9375AB5A7C22D400C58D34DB964ECDCD57F241B6F88C8003F120AF9E
SHA-512:	6AE19C678083E07EECAD15BC08DE8431D11C628DF6F68175942575FD4912E2BED8C12C3D80AE82A3F89E94D3C2B27F5E08B7FD03FB5D5B61C7B6B12B5C29DC66
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......yikR..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yz.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}.X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009661059299823
Encrypted:	false
SSDEEP:	48:8xnddRsTCmsHuidAKZdA14tseh7sFiZUkmgqeh7sWy+BX:8xnWznn8y
MD5:	3C0D3B51B58E864F18FB0B44C9B7B7AB
SHA1:	81328E1EE38670BE5D0805D805B81B7C3BDB44BB
SHA-256:	3DA2402F3C2812B7B3F979123B8CF3312239252E4F5B0D5294B715FE4EB88C8F
SHA-512:	DED662B830ACE9E7FE0168ACA4776C71FF040A7E0BFCEAD164D077D43599FCFFE7422F5ABFC6023672CED5181B9BFF5CAA3EEB26C1A2E0BCBB6072744482AA1C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yz.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}.X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 19 22:12:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992178127004534
Encrypted:	false
SSDEEP:	48:8YddRsTCmeHuidAKZdA1vehDiZUkwqehky+R:8YWzeey
MD5:	89DE3AB8ECFEFEFCCE665B5539D50157
SHA1:	E23AC24E8286812ED1C9D4CE15EEBAB087DAB2AC
SHA-256:	A5C95A822C5588AF2C0BD7211DED23BBC50A67522325E15CF5EA491FBD2CE856
SHA-512:	D030CD9356076C1A818B0F14455818F2BFAB764AE9E85804522476BD8095EC2F95C89C1F51B8E2D86C4C770FB03330421C8F3A31AB98D58F43840601ECAE19D9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....k.kikR..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yz.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}.X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 19 22:12:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.984589425683007
Encrypted:	false
SSDEEP:	48:8bddRsTCmeHuidAKZdA1hehBiZUk1W1qeh6y+C:8bWzu9ay
MD5:	7C5285A15D0AC3EDB61331774CA5F0DA
SHA1:	87B46AFA62365B98905BB4B6CA6C5D2A6D93E621
SHA-256:	400F900A325B4CB6FA7E28FBF8C2D43247DE2C06AA4DF16DCFCCE5037DC29A7B
SHA-512:	CE625D2B8BD9F812D201F911F46F6E97FB84B23E00119B47E1FD8C733B3186227FE9E61F033E681D0AE2A68E2DF6603163AECEFA812BA701CA7018E802D7DA00
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......ikR..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yz.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}.X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 19 22:12:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.993248146721386
Encrypted:	false
SSDEEP:	48:8eddRsTCmeHuidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb8y+yT+:8eWzQT/TbxWOvTb8y7T
MD5:	A5D06B9180C60FD40235E9EE42DBF727
SHA1:	7C013D15B0C3EB266D0A1539852E6D5C781B8483
SHA-256:	C01948BBF867CDA678C84CF69B99A68334FDE25CDAD0C33785860C11848C064D
SHA-512:	84C797DCD59D8314905D7F9368DE2399AD886E3AA1DC0574576048AF934C72487004D0F8E100EC12F6DC9370D7D4A048A75B38C489DF3708212AAEFF620FE444
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....?[ikR..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yz.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}.X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.036363976478960836
Encrypted:	false
SSDEEP:	3:G+VKjSCEkoVA1XollkVKjSCEkoVA1NXdlL9//dl1ltl:G5EAxojEArXL9X11
MD5:	480229E07A24CA433675871926C21523
SHA1:	96E02883A9B21CB84C752A49903A5125887D5B2E
SHA-256:	989507F643ABD9ACF80A989FEDA693FF9FF45341B173C3AB2F8E6EFA608C67DF
SHA-512:	7E6418EAC24D164F9440ED2E11AC6EB580AE95258EE856AF3FCB6A581DFA5CF213656EA759DC6B17EB69579F91A9CDD629815AA12FE6257C6C45883BE398543A
Malicious:	true
Reputation:	unknown
Preview:	..-.....................g..!..'a.j..;'jB...pe.....-.....................g..!..'a.j..;'jB...pe...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03984870453112046
Encrypted:	false
SSDEEP:	3:Ol10eCPV8U2NJN4bVhRv/rl8rEXsxdwhml8XW3R2:KGcn+7l8dMhm93w
MD5:	C04E10851D42F9FA63D79F2790104FD8
SHA1:	06C48C20E6E01F35DD951D371036C16FAECD5369
SHA-256:	5CEE171523C3A5C36524EB66BEFFAEC147E3E6739EFBDFAAA3DEFFA8DF5EFBC0
SHA-512:	FCC45F7C9E334F38295EAD5DB313F7592383092DC9D496EA5DBFDBEDEDE0F288B30A54BC1917B3C9031B78324E0D569A92AC8F4A0FE2A6173E21EB5606310E92
Malicious:	true
Reputation:	unknown
Preview:	7....-...........j..;'jB.Wm...l..........j..;'jB~p......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	modified
Size (bytes):	11781
Entropy (8bit):	5.464671942978295
Encrypted:	false
SSDEEP:	192:bnPOeRnLYbBp6XJ0aX+H6SEXK5NVa5RHWNBw8dFSl:bDeWJUascHEwu0
MD5:	8C560B03B00315C39D2F8EC1C8DC7B84
SHA1:	F00301815095D868640C9E07434E44DD16BCEAD3
SHA-256:	350AAF5C2D139F6A2F22550499C84322C117899F64D5E42880DECB5F6A73E3A3
SHA-512:	2D661984B04AEC0E42302F4ADBEA3370965DBE1730726AEB87AF88F2FE3E885E0CD4971F57AC1AA1C839CC5C0DF341CB7946739D12F94C5D7A9647991BA13BE7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1734655977);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11781
Entropy (8bit):	5.464671942978295
Encrypted:	false
SSDEEP:	192:bnPOeRnLYbBp6XJ0aX+H6SEXK5NVa5RHWNBw8dFSl:bDeWJUascHEwu0
MD5:	8C560B03B00315C39D2F8EC1C8DC7B84
SHA1:	F00301815095D868640C9E07434E44DD16BCEAD3
SHA-256:	350AAF5C2D139F6A2F22550499C84322C117899F64D5E42880DECB5F6A73E3A3
SHA-512:	2D661984B04AEC0E42302F4ADBEA3370965DBE1730726AEB87AF88F2FE3E885E0CD4971F57AC1AA1C839CC5C0DF341CB7946739D12F94C5D7A9647991BA13BE7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1734655977);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.417034625319804
Encrypted:	false
SSDEEP:	6:dcNqVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lHtVut0:RuQ1CGAFifXVHit0
MD5:	A0D05AA6B9F5CC74B555E8C4AC3815CC
SHA1:	E2D836B01D93D6E1768E5722AEB6E93D574D37E4
SHA-256:	DFDEB6F347561B6E6D811EE4D98AFA11B3EDE9F746E5D1F27D3D5FF2C3889CD5
SHA-512:	71DA91EFFD446A67E83C97C6F6A40FA00DA6B6F20BCA23A247623A9516743554B01B402568312DE3E92EC09B366D7C3A4A43422AE71C1DA7C66E920ECC574130
Malicious:	false
Reputation:	unknown
Preview:	.....O...%.I.1Y/..[.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	6.454649285943866
Encrypted:	false
SSDEEP:	3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyXzdEpx:A/rLVPW0nsP2Xy+TJfWzW7
MD5:	CC36E2A5A3C64941A79C31CA320E9797
SHA1:	50C8F5DB809CFEC84735C9F4DCD6B55D53DFD9F5
SHA-256:	6FEC179C363190199C1DCDF822BE4D6B1F5C4895EBC7148A8FC9FA9512EEADE8
SHA-512:	FCEA6D62DC047E40182DC4FF1E0522CA935F9AEEFDB1517957977BC5D9AC654285A973261401F3B98ABF1F6ED62638B9E31306FD7AAEB67214CA42DFC2888AF0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ag.....................`....................@...........................#.............................................(................................p#.........................................\............................................text...x........................... ....rdata...1.......2..................@..@.data....!!..0......................@....00cfg.......`#......*..............@..@.reloc.......p#......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1058336
Entropy (8bit):	6.827880169201504
Encrypted:	false
SSDEEP:	12288:qvUGQWpy+Tac0RDffXJjyYpcyoNHSy5viczPESsQ3BaE32VfXJjyYpz:lGQB+2DR7BWYpcyo44u0aPVBWYpz
MD5:	971B0519B1C0461DB6700610E5E9CA8E
SHA1:	9A262218310F976AAF837E54B4842E53E73BE088
SHA-256:	47CF75570C1ECA775B2DD1823233D7C40924D3A8D93E0E78C943219CF391D023
SHA-512:	D234A9C5A1DA8415CD4D2626797197039F2537E98F8F43D155F815A7867876CBC1BF466BE58677C79A9199EA47D146A174998D21EF0AEBC29A4B0443F8857CB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w.m..........."...0......(........... ........@.. ....................... ............`.................................K...O....... %.............. r..........p...T............................................ ............... ..H............text........ ...................... ..`.rsrc... %.......&..................@..@.reloc..............................@..B........................H........7................................................................{8.....{9.....{:.....{;.....{<.....{=.....{>.....{?.....{@.....{A.....{B....0..\........(C.....}8.....}9.....}:......};......}<......}=......}>......}?......}@......}A......}B....0...........u.......;.....9....(D....{8....{8...oE...9....(F....{9....{9...oG...9....(H....{:....{:...oI...9....(J....{;....{;...oK...9....(L....{<....{<...oM...9....(N....{=....{=...oO...,w(P....{>....{>...oQ...,_(

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3915)
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	5.83565188276101
Encrypted:	false
SSDEEP:	96:cjliYIN6666VtJc0doo3LBXJ0BfyOhU24n9xDgTtNiR4UCBXfffffo:cZkN6666VtHd13VL9S7igS
MD5:	5AF9970D99D82772F4B5AFD3A611C344
SHA1:	AD08125DE54F7EA2682258730BAD4EC181E4CD2E
SHA-256:	EBE3DD70E3E4413BAD8E90A29354B19F7875599394FC6677C9D70EE66A468B35
SHA-512:	55B029AE0410F2B7B8021A2EDEE195FA00EB661DE765151D2DD53AED90BDF78B5C76DCC6B987D759657162E262779C402ADE3BEFB8FF5588FBF7C6C5CE5F9BD1
Malicious:	false
Reputation:	unknown
Preview:	)]}'.["",["fred lorenzen nascar","archies festival frenzy bo6","sambuca restaurant closure houston","steam winter sale 2024 games","nasa astronauts stuck in space","stranger things season 5 release date","intercontinental cup real madrid pachuca","ban tp link routers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgkvbS8wOTg1ZGQSIUZyZWQgTG9yZW56ZW4g4oCUIFJhY2UgY2FyIGRyaXZlcjLDEGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFDQXdBREFBQUFBQUFBQUFBQUFBQUZCZ01FQndFQ0NQL0VBRGNRQUFFREFnUURCUVlFQndFQUFBQUFBQUVDQXdRRkVRQUdFaUVUTVZGQllYR0JrUlFWSWpLaHNRZENnc0Vq

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe
File Type:	Non-ISO extended-ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2991
Entropy (8bit):	5.260656765784018
Encrypted:	false
SSDEEP:	48:5vVnS2bzticY+3OtZY+3fbzticB+3OtZB+3mlPwY2SaYP2JcD2SdDPVlxb0xObOr:2op2TmhOPwV5bxqxgxQO+M
MD5:	0F062C86BDF4E1612E9BBEDC05F621C6
SHA1:	2945B3AE87634ECD232582EDF7BDB92E6651C716
SHA-256:	FC3A11C7C780152E2C7AB5B4886DB39E6855547137F5EBFD9C152870BB1F0D93
SHA-512:	98E9FF00FCC75AB8AC86DFC51CF9A09BF9E09D83797B64DA019C4643D3A5D3C4E8851E2DD27E11E685D9F203EB96AF18B8F61A4FEC091AF198AD8A6F29D7020B
Malicious:	false
Reputation:	unknown
Preview:	Ordner erstellt: C:\iatnfvyzl..Willkommen beim Textanalyseprogramm!..Geben Sie Text f.r die Analyse ein (2 Sekunden Zeit):...Die Zeit ist abgelaufen! Die Eingabe wurde nicht abgeschlossen...Generiere einen zuf.lligen Satz.....Generierter Satz: Hund Stuhl Tisch Blume..Anzahl der W.rter: 4..Fehler beim Hinzuf.gen des Ausschlusses: Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\iatnfvyzl..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\iatnfvyzl..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : N

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.553754884227523
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'023'360 bytes
MD5:	8c724813b4468960543fcbcb4635f74f
SHA1:	23693d84c1441a3edc77686c5a613f747ccff8a6
SHA256:	4cc2d946c5c43426f509193cb5bee665f59f46c795c4da045d3b5940d660e6d4
SHA512:	c10f32547cd5a5921fa826eb11d437887b13b75ecd6d4a284288e12498e9d5406a779fb2fa2632d38412b6310dc53fca530e59dc3b80db76165431b2cf405cfa
SSDEEP:	49152:Zr515k/dk6Cw71eUMEdzK8Epe8C4IYilUBEhfqluQpq+K:5515k1klQ19LdzK8EpHICEc0aK
TLSH:	40E55B53B50A72CFC08E1778893FCE425D5E87B9072118D7A86DA4BABE73CC215B6D24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F70846E5F2Ah
verw word ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+1Eh], ah
adc dword ptr [eax], edx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [esi], bl
adc dword ptr [eax], edx
add byte ptr [eax], al
add byte ptr [eax], al
wait
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31b198	0x10	kfjqblss
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31b148	0x18	kfjqblss
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	58e4d40286efe69d7aee2e933d1ab4d6	False	0.9983129683242506	data	7.985538983935103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x400	0351588ff312fd8e04743630fad5ef17	False	0.71484375	data	5.82962806421812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kfjqblss	0x6b000	0x2b1000	0x2b0800	d540b1eb0234a24e91bb49adc9421cdc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vivpivkj	0x31c000	0x1000	0x400	42d1f2624493c8b08d5f52c30427a395	False	0.8056640625	data	6.2532936761395534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31d000	0x3000	0x2200	effbb8f0f503059fd19fa41fea8de9fe	False	0.052964154411764705	Applesoft BASIC program data, first line number 15	0.9089317775406961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x31b1a8	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x31b58c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	18:10:13
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe10000
File size:	3'023'360 bytes
MD5 hash:	8C724813B4468960543FCBCB4635F74F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2160698202.0000000004780000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:10:16
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x190000
File size:	3'023'360 bytes
MD5 hash:	8C724813B4468960543FCBCB4635F74F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2202358687.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:10:16
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x190000
File size:	3'023'360 bytes
MD5 hash:	8C724813B4468960543FCBCB4635F74F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2200230498.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:11:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x190000
File size:	3'023'360 bytes
MD5 hash:	8C724813B4468960543FCBCB4635F74F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2630147663.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:11:12
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"
Imagebase:	0xdb0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:11:12
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:11:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017975001\a2236cc5aa.exe"
Imagebase:	0xdb0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.3006312115.0000000001288000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:11:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017977001\e565baa4b6.exe"
Imagebase:	0xdc0000
File size:	1'885'696 bytes
MD5 hash:	25FB9C54265BBACC7A055174479F0B70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	18:11:25
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017978001\3494904393.exe"
Imagebase:	0x530000
File size:	22'016 bytes
MD5 hash:	04F57C6FB2B2CD8DCC4B38E4A93D4366
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000B.00000002.3062210997.0000000003890000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000B.00000002.3062210997.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:11:25
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:11:28
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\iatnfvyzl"
Imagebase:	0xb90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:11:28
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:11:31
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0xb90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:11:31
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:11:33
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"
Imagebase:	0xb70000
File size:	1'800'704 bytes
MD5 hash:	3647AF905F92B479113300608444F101
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:11:43
Start date:	19/12/2024
Path:	C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe
Wow64 process (32bit):	true
Commandline:	"C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe"
Imagebase:	0x400000
File size:	147'968 bytes
MD5 hash:	CC36E2A5A3C64941A79C31CA320E9797
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\iatnfvyzl\63506cf0a7384158900a9c4410789dbd.exe, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	18:11:43
Start date:	19/12/2024
Path:	C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe
Wow64 process (32bit):	false
Commandline:	"C:\iatnfvyzl\9c439e52050a49e0875bf199b254f370.exe"
Imagebase:	0x18167330000
File size:	1'058'336 bytes
MD5 hash:	971B0519B1C0461DB6700610E5E9CA8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:11:43
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe"
Imagebase:	0x7d0000
File size:	2'893'824 bytes
MD5 hash:	2854309DFD78A64E325E67004B94ADDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000003.3086871686.0000000005210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	18:11:44
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	18:11:47
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"
Imagebase:	0xb70000
File size:	1'800'704 bytes
MD5 hash:	3647AF905F92B479113300608444F101
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.3258078775.000000000169B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.3275631067.000000000169B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.3258078775.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.3275631067.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.3335757490.000000000169B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.3334478529.000000000169B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	18:11:51
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe"
Imagebase:	0x350000
File size:	970'240 bytes
MD5 hash:	134E8ED7546996583F248F49C87D99A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	18:11:54
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:11:54
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:11:56
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017979001\128703c003.exe"
Imagebase:	0xb70000
File size:	1'800'704 bytes
MD5 hash:	3647AF905F92B479113300608444F101
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3500289993.0000000001354000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3503373239.0000000001355000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3501962670.0000000001354000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	18:11:56
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:11:56
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	18:11:56
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	18:11:56
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	18:11:57
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	18:11:57
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	18:11:58
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	18:11:58
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	18:11:58
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	18:11:58
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	18:11:58
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	18:11:59
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2108,i,8456486069817355234,11844497876439490650,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	18:11:59
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	18:12:01
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3116d80-26e5-4678-b47c-6e372794e0eb} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2800d16fd10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	18:12:01
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe"
Imagebase:	0x9b0000
File size:	2'817'024 bytes
MD5 hash:	27D1C23073BBF3BE2092A18AB4CF9818
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	18:12:03
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	18:12:04
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2244,i,11399492537237456067,12274902701966245916,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	18:12:04
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017980001\8a13e339a3.exe"
Imagebase:	0x7d0000
File size:	2'893'824 bytes
MD5 hash:	2854309DFD78A64E325E67004B94ADDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000003.3288737853.0000000004830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	18:12:06
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -parentBuildID 20230927232528 -prefsHandle 4300 -prefMapHandle 4304 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {822619a6-5657-47d3-80bf-2521004ff1f0} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 28020772b10 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	18:12:12
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017981001\7ccdd68f3b.exe"
Imagebase:	0x350000
File size:	970'240 bytes
MD5 hash:	134E8ED7546996583F248F49C87D99A2
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	18:12:13
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	18:12:13
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2228,i,13984323130618621561,12790505923431820552,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	18:12:18
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017984001\ebfedd813b.exe"
Imagebase:	0x950000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 67%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	18:12:21
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017982001\2fc1eb1411.exe"
Imagebase:	0x9b0000
File size:	2'817'024 bytes
MD5 hash:	27D1C23073BBF3BE2092A18AB4CF9818
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	18:12:22
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	18:12:23
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x2a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	18:12:23
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2268,i,11916466110525037174,8440217537469921044,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	18:12:23
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	18:12:24
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	750
Total number of Limit Nodes:	24

Executed Functions

Function 00E4652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00E4652A,?,?,?,?,?,00E47661), ref: 00E46567

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5f767a97a43af938bfd5095905987a26342d977b1a1a7e04bcccd082704bd23d
Instruction ID: 1681fb227a9ef1031e422054e9bae7b2279f54d0aef7285ee6d3d93904b06a7e
Opcode Fuzzy Hash: 5f767a97a43af938bfd5095905987a26342d977b1a1a7e04bcccd082704bd23d
Instruction Fuzzy Hash: BAE086300411086FCE25BF18D849D4D3B59EB5275EF042C10F90D9A126CB29ED42C541

Function 049A0C4E Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7382993936ac7cce9a21911580fa77a79e61f0bb061110ede4802bbaad31de6d
Instruction ID: 1f0731064e11967b85e7bd3ef333db585945c514a02c877a4f68af083e3c4a56
Opcode Fuzzy Hash: 7382993936ac7cce9a21911580fa77a79e61f0bb061110ede4802bbaad31de6d
Instruction Fuzzy Hash: BE1193EB24D220BDB14189826B54AFB676ED1D6B30731C83BF806C5506E2992E6E7172

Function 00E15C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 00E160FA
00000422, xrefs: 00E160C9
Keyboard Layout\Preload, xrefs: 00E16054
00000419, xrefs: 00E16098
0000043f, xrefs: 00E1612B

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: d2fd4b0fdff712d78c32854356c1932cc8f90a6dcab22884d28c3efba9e19e0a
Instruction ID: 39127cb5279fc4d6411363a8485b21631a2064244f1400149dc553976e6a3885
Opcode Fuzzy Hash: d2fd4b0fdff712d78c32854356c1932cc8f90a6dcab22884d28c3efba9e19e0a
Instruction Fuzzy Hash: 22F1D071A002589FEB24DF14CD85BDEBBB9EB84304F5046A9E518B72C1DB749AC4CF91

Function 00E19BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 9d81af3b5af2324dce86289aba652f8c8cd6254c875ee01c96dbddd5440f8b5d
Instruction ID: fc5c75adb4bfbc3da6a08b0c67dda3d7691a2ce7f040a310018d5a85240825a8
Opcode Fuzzy Hash: 9d81af3b5af2324dce86289aba652f8c8cd6254c875ee01c96dbddd5440f8b5d
Instruction Fuzzy Hash: 6A3148716052448BEB08DB78EC99BEDF7A2EBC2324F249228E054F73D6C77999C08751

Function 00E19F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: e08bb39c2db8cde33d71711fd6d8d4698fc73a12d9eb5d0c868f971b2c30da30
Instruction ID: 16fe867e60e79a07836a7d88af15eff14f70a515ffd2dc03fc0063d49af0478e
Opcode Fuzzy Hash: e08bb39c2db8cde33d71711fd6d8d4698fc73a12d9eb5d0c868f971b2c30da30
Instruction Fuzzy Hash: 733146317051009BEB089B78EC98BFCB7A2EBCA314F289229E014F72D6C73599C08752

Function 00E1A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 7f6c6974c2bd9e80711b54ee69756241aedc2db50a82c493f7a2da3e247267af
Instruction ID: 0a613158db99dd3b5cf9945f3cc7be0f1602336a1d7f28e8365b7e37d9a1ec47
Opcode Fuzzy Hash: 7f6c6974c2bd9e80711b54ee69756241aedc2db50a82c493f7a2da3e247267af
Instruction Fuzzy Hash: 943128717061009BEB18DB78ED89BBDB7A2EBC6314F285228E014F72D5C77559C08652

Function 00E1A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: cc652010c09bf4eb7ad10cf96c367c97ad2eb654ad9c3df5c2a60f2c2b840cd2
Instruction ID: 7f1bdb3efd3083891f59cbefa9f0ab9eb72408d3c72322ce977ac08df687fe34
Opcode Fuzzy Hash: cc652010c09bf4eb7ad10cf96c367c97ad2eb654ad9c3df5c2a60f2c2b840cd2
Instruction Fuzzy Hash: 733105717061409BEB189B78EC89BFDB7A2EFC6314F285228E014B72E5D77699C08652

Function 00E1A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 54e29b31394e09173c3f0c7c2fb55d70b7341925d41f012fc14e08b0d6d274a1
Instruction ID: 014de02b0a1e8eaedd2c4673d4c9e421358822db4ced4db896b396f87474a660
Opcode Fuzzy Hash: 54e29b31394e09173c3f0c7c2fb55d70b7341925d41f012fc14e08b0d6d274a1
Instruction Fuzzy Hash: 873107716061009BEB189B78EDC9BFDB7A2EFC2318F286228E064B72D5D77559C08652

Function 00E1A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: bbd086df6b7e98593a234ee935fd7ab8d3a1b4798bf5f451d8ae5e215ccbf4e3
Instruction ID: 775abbc36415552aa4cf69bd378a82b6a2921673ead3da9c60b588dc6c026b92
Opcode Fuzzy Hash: bbd086df6b7e98593a234ee935fd7ab8d3a1b4798bf5f451d8ae5e215ccbf4e3
Instruction Fuzzy Hash: A9312A316061408BEB18DB78EDC9BBCB7A2EBC6318F285228E054F72D5C73599C08712

Function 00E1A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 5f765b72d59fbeddf8926b5b9d849554d127254c598244284dc43b4251c93ec5
Instruction ID: db91c327c5e1a0696acee81578d597691bc1620ab3d4cf1a70babb77498400c5
Opcode Fuzzy Hash: 5f765b72d59fbeddf8926b5b9d849554d127254c598244284dc43b4251c93ec5
Instruction Fuzzy Hash: E23128716061409BEB18DB78ED89BBDB7A2EBC2324F289229E054F72D5C73559C08652

Function 00E19ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 48766e3a6c80e3c1e29fe6dafd6d612e44f2e94f1b6edf7d29504c8ffc912a81
Instruction ID: 75f6cd12a3c0c2596d75cd9b84b0d7fc0440d8f7edbc001ab329eb9b34b797d0
Opcode Fuzzy Hash: 48766e3a6c80e3c1e29fe6dafd6d612e44f2e94f1b6edf7d29504c8ffc912a81
Instruction Fuzzy Hash: 60214C317052009BFB189F68FCD5BACF7A1EBC1314F245229E418F72D5D77559C08611

Function 00E1A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 566a1a0d57b645202a6ce32f9452385b2473a69b90d22b7d3150331800930159
Instruction ID: 50c5ef31ca4cf27d798c319d299a80a0de637108d64934506915f0ca11d656b9
Opcode Fuzzy Hash: 566a1a0d57b645202a6ce32f9452385b2473a69b90d22b7d3150331800930159
Instruction Fuzzy Hash: C721307124A2049AF7285B6CEC9E7FDF3A1DFC2704F282536E544F62D2CA7645C15153

Function 00E1A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E1A963
CreateMutexA.KERNEL32(00000000,00000000,00E73254), ref: 00E1A981

Strings

T2, xrefs: 00E1A970

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 13bbeaf83980f64259c28537f535ac9391a12134ae23b48aa64a495887eb4acc
Instruction ID: 74b098e3cf241dd68187578abe58e200c7133cf68f06d780dd50eb5bc1b14d27
Opcode Fuzzy Hash: 13bbeaf83980f64259c28537f535ac9391a12134ae23b48aa64a495887eb4acc
Instruction Fuzzy Hash: 902149317062009BFB189B68EC89BBCF7A2EBC2315F285239E418F76D5C77955C08252

Function 00E17D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00E17ED3

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 831c414ba87d82c46e466fc6c8da0e46db79f3079241c3108fda16d89801d84d
Instruction ID: 92ed313733253b785477ebb3412a3f5698c907c1d53bc6fb65d5867021982d52
Opcode Fuzzy Hash: 831c414ba87d82c46e466fc6c8da0e46db79f3079241c3108fda16d89801d84d
Instruction Fuzzy Hash: 65E1F3B1E00214DBDB14BB289D473DE7AB1AB85724F94628CE459773C2DB744EC58BC2

Function 00E4D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E4A813,00000001,00000364,00000006,000000FF,?,00E4EE3F,?,00000004,00000000,?,?), ref: 00E4D870

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5737c74e8a8260c060479e82fd298871f62c41559518bb31ea839235799ee325
Instruction ID: 59cd101d3dabdd2518c9258733b2802c44009f019d1efa941eb235fc549a41be
Opcode Fuzzy Hash: 5737c74e8a8260c060479e82fd298871f62c41559518bb31ea839235799ee325
Instruction Fuzzy Hash: 3BF0E93250D12466DB296A72BC02B7B3799DF99770B15B021EC04F7191DA20DC0085E0

Function 00E187B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00E1DA1D,?,?,?,?), ref: 00E187B9

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 92c95fcad2359ca9c6be26101a9021c9f762bc9a3e07d3736fed21eb7d13a338
Instruction ID: 678b676f808e7ccceb379b121a1ade337cb4b2c8ed82af8f17191891b506597b
Opcode Fuzzy Hash: 92c95fcad2359ca9c6be26101a9021c9f762bc9a3e07d3736fed21eb7d13a338
Instruction Fuzzy Hash: B8C08C3801260009FD1C053842948F83349AB87BFC3F43B85E0B0FB1E1CB356887A210

Function 00E187B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00E1DA1D,?,?,?,?), ref: 00E187B9

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 673264bad21cc6d932995451d93800cca0239e2fa70fb4c93710273367621167
Instruction ID: 6ab6626f8a761e3362f0fbd22c5bef6eee5e12714d8348f2f8c19ba1fda1141b
Opcode Fuzzy Hash: 673264bad21cc6d932995451d93800cca0239e2fa70fb4c93710273367621167
Instruction Fuzzy Hash: 59C08C380122004AFA1C4A3892948B43209AB43B6D3F02B99E071FB1E1CB32D483D6A0

Function 00E1B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00E1B3C8

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7f7ac8ddec6425e0e34a89fbdfccfcfb96deae77124305228a04118593ac852a
Instruction ID: 6cdd24e4b93737c43a2f0bed8c5820d01f22b8ed78e536f5b1dd16dafe113bce
Opcode Fuzzy Hash: 7f7ac8ddec6425e0e34a89fbdfccfcfb96deae77124305228a04118593ac852a
Instruction Fuzzy Hash: 03B11670A11268DFEB28CF14CD94BDEB7B5EF59304F5085D8E809A7281D775AA88CF90

Function 049A0C58 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c688dcc58b8e9517713ea2a1c62033835fc4fbde055e28ab142466a1d2cd58
Instruction ID: 93349062a179b6905cca4eeed3a26ac3191856e77e210fd27170144c30ad6424
Opcode Fuzzy Hash: 67c688dcc58b8e9517713ea2a1c62033835fc4fbde055e28ab142466a1d2cd58
Instruction Fuzzy Hash: 881106FB24D210BDB14189826B24AFB67BED1C6B30731C83BF807C6506E2952E5D7172

Function 049A0C64 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b13388c608af71e48d5e4adec1912a8e5690c5b41114b1a4b79291d6476ec4
Instruction ID: 9c813976c99ba63e4f3a8e69f366de340cd1d83d72df82acb6819b8387112cfe
Opcode Fuzzy Hash: 52b13388c608af71e48d5e4adec1912a8e5690c5b41114b1a4b79291d6476ec4
Instruction Fuzzy Hash: 4F11A5EB24D2107DB14189827B54AFB676EE1D6B30731C83BF806C5506E2992E5E7172

Function 049A0CAB Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4a1086e785b110b6af23befb601767c4b3a219aafe72e52a8986e05f4b23c1
Instruction ID: 6338be5a71d104259680b22ffe581bd83fb6faa2c7bce16b949aea670390364e
Opcode Fuzzy Hash: cc4a1086e785b110b6af23befb601767c4b3a219aafe72e52a8986e05f4b23c1
Instruction Fuzzy Hash: 9301FCF724D340BDB2418995AB44DF67B6DD6C66343308C7FF806C6043E2552A2DB172

Function 049A0C97 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8520f264cda98ff3462cecbcaad144de7b5ed45d0b60d59701aa0b273c247299
Instruction ID: d466a3a8d8d9269f66b5117773a46a15ed4e0c635ae617efc7eaea8826fb432a
Opcode Fuzzy Hash: 8520f264cda98ff3462cecbcaad144de7b5ed45d0b60d59701aa0b273c247299
Instruction Fuzzy Hash: 74F06DBB30D210ADB1418996BB50AF767AED2D6B30730CC36F80AC6142E2953A697171

Function 049A0CF9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af95b70c9627c754ea9471dec2d12f554b2cb5a7d99cbcee749d9954d01b212
Instruction ID: fefb673f5fa9d1885e3362a34a6428f028706683ceb3e3a77688a0c0c35023f4
Opcode Fuzzy Hash: 4af95b70c9627c754ea9471dec2d12f554b2cb5a7d99cbcee749d9954d01b212
Instruction Fuzzy Hash: 0FF081FB34D210BDB1418992AB50AFA67AED6D6B30731CC3AF407C6102F2952E6D71B1

Function 049A0CDD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204262100.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0cd9fd3d08364f7ea3f7a641dff96853e8a48e0dfe4523b498e13b87efaba1f
Instruction ID: 28909626df5ffb44303612f183e9798169e13069dd1076d3e1981dfe2c4ef2d8
Opcode Fuzzy Hash: d0cd9fd3d08364f7ea3f7a641dff96853e8a48e0dfe4523b498e13b87efaba1f
Instruction Fuzzy Hash: 34F05EE720D250BCF19198927B54BF7576EC2D6734731C93BF406C4502E28A2A6E7172

Non-executed Functions

Function 00E531A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E53323

Strings

1#SNAN, xrefs: 00E544BA
1#INF, xrefs: 00E544DE
1#IND, xrefs: 00E544B3
1#QNAN, xrefs: 00E544C1

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: bd2e3352ce1b07becec4d0d2fc25984898d0aea7d93f14cd2f141d1de48f7c50
Instruction ID: 8fd947b678f46bb6113705f4e2cc4f829beb2cb33745161a4e4ba3cafcf762a2
Opcode Fuzzy Hash: bd2e3352ce1b07becec4d0d2fc25984898d0aea7d93f14cd2f141d1de48f7c50
Instruction Fuzzy Hash: 3EC24EB1E046288FDB25CE28DD407EAB3B5EB4434AF1455EAD84DF7240E775AE898F40

Function 00E1E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00E1E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00E1E140

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 31f3aa4546e37df5f6c81866fbd8c3f33b976245e347cf76c5c0671fb8facdbd
Instruction ID: 13a9d80570b3949b1833c25bb048fb6314328a4dfd3d7d94c32fb3102a8a869f
Opcode Fuzzy Hash: 31f3aa4546e37df5f6c81866fbd8c3f33b976245e347cf76c5c0671fb8facdbd
Instruction Fuzzy Hash: 2931C771A402589FD720CB69DC85BEF77BCEB08728F101625F915F7391D674A8888F60

Function 00E52D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: f6d567ffe1460f4157a4c911ad2bea4b34f42cce77c49a97823cd303a4f68744
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: E3F15C71E012199BDF14CFA8C9806AEB7F1FF49315F25866DD919BB380D731AE058B90

Function 00E2CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00E2CF52,?,00000003,00000003,?,00E2CF87,?,?,?,00000003,00000003,?,00E2C4FD,00E12FB9,00000001), ref: 00E2CC03

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 29664b668a6074a14635f084cc345bb0be9b0575f2168b38681794680cf97171
Instruction ID: 210b5a467086b3965cd0c93484e71247f2237a4c0223bdd011746fd7caaafde0
Opcode Fuzzy Hash: 29664b668a6074a14635f084cc345bb0be9b0575f2168b38681794680cf97171
Instruction Fuzzy Hash: AFD012325426389B8A556B95FC058EEFB58DF45B683145122ED0D77130CAD16C40DBD5

Function 00E47F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00E480B2

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 8c22457309bf093a004427c77028f7d3bf12a518077d507c5029eec237bb49ea
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: B1517B707186045AEB388A28BA957BE67DA9F51308F14351AE4C2F7392CF629D4DC291

Function 00E14DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82ebf46ccfcea1ad2b444bcc9baa22ed2ba85e844da2acef37a1fd7b3ba6043
Instruction ID: 026806f97f8073bcb1b32bef0298f5302ef041c021cb8310d99a709cb21a4c81
Opcode Fuzzy Hash: e82ebf46ccfcea1ad2b444bcc9baa22ed2ba85e844da2acef37a1fd7b3ba6043
Instruction Fuzzy Hash: 412260B3F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E903DA40AE3345EA79D9158644

Function 00E57049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42f78b563cdb3a4eefeb73c3cc235037d8df8920942e6e353eeee7359a76e62
Instruction ID: 44f7ef013faa8a4e8b890aa778f062041af936daba91fd71a213b444bb8991ba
Opcode Fuzzy Hash: e42f78b563cdb3a4eefeb73c3cc235037d8df8920942e6e353eeee7359a76e62
Instruction Fuzzy Hash: A9B16A312146048FD714CF28D486BA57BE0FF4536AF259A58ECD9DF2A1C335E9A6CB40

Function 00E14B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de99bd84d41bc60445db6286c523cc6c87bfca4f17e7dcdace73234b346265e
Instruction ID: 654d7de853a780616d06b803c48410798ffcbfd136d81fb3c231b95fa7d4f87a
Opcode Fuzzy Hash: 8de99bd84d41bc60445db6286c523cc6c87bfca4f17e7dcdace73234b346265e
Instruction Fuzzy Hash: 1281FFB1A042458FEB15CF69E890BEEFBF1FB19300F151669D954B7392C3319989CBA0

Function 00E578BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9c3c92ce7dda8d91ca80334f7834e173f44fbc2e63121c3a6f629e7ed4c7ea
Instruction ID: d23c4c27f42e4a3b5e8b5c9707bfb7b200b4b717139d9dfedd4db1031cd656ab
Opcode Fuzzy Hash: 6d9c3c92ce7dda8d91ca80334f7834e173f44fbc2e63121c3a6f629e7ed4c7ea
Instruction Fuzzy Hash: 1021B673F204394B770CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00E5779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36045080d8a0b67743f02e6acd7bca56fc3f405101f5e2f989fac2c0762a378d
Instruction ID: e3ac75a371d1c5d43faf8cdec879ff95fae65ef5ff6625f0b328ad47daec285b
Opcode Fuzzy Hash: 36045080d8a0b67743f02e6acd7bca56fc3f405101f5e2f989fac2c0762a378d
Instruction Fuzzy Hash: 1F118623F30C355B775C816D8C172BAA5D2EBD825071F533AD826F7284E9A4DE23D290

Function 00E58860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 9ad59974b643b744ef843189915c0e30de1d1a5264043b12e83dac18c00d0808
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 22112E7720014183E60C862DCAF46B7A795EBC532B7EC6B75D8417B754DA22D94D9600

Function 00E4A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 9564f3988a40aa71d1a8b663b19a50883f318ed2e74609a8dcb4cab876fa6475
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 7BE08C32961228EBCB14DF98E90498EF3FCEB49B10B6910A6F501E3150D270DE00C7D0

Function 00E4CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E4CC66

Strings

v, xrefs: 00E4CBE1

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v
API String ID: 3213747228-1361604894
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: b7bac414bb533b9e896c7bfcdbd4734c1f460a706ca87a19d4020077db76960c
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 7BB12332E026459FDB15CF28D8817FEBBE5EF45344F25916AE855FB242D6348D02CBA0

Function 00E12EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00E12F5F
__Mtx_unlock.LIBCPMT ref: 00E12FCC
__Cnd_broadcast.LIBCPMT ref: 00E12FE3
__Mtx_unlock.LIBCPMT ref: 00E130F5
__Mtx_unlock.LIBCPMT ref: 00E1319B

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 7810267772885308c32a46534d17bc1936e44f1ae18e714b90d3d70244a082c7
Instruction ID: d01cbb7547d61843bac4b57d186cb6134c75ed4b57dff59418161302d23f44e5
Opcode Fuzzy Hash: 7810267772885308c32a46534d17bc1936e44f1ae18e714b90d3d70244a082c7
Instruction Fuzzy Hash: 10A1F1B1A01615EFDB20DF74D94479AB7E8FF18318F14A129E816F7241EB31EA84CB91

Function 00E2BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00E2BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00E2BBE4
_xtime_get.LIBCPMT ref: 00E2BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00E2BC13

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 3e8cb1c0501ad089ea6b6cc6f45962ba37e5e2d583b418bca81a1d4536d45afa
Instruction ID: 325c3eba16affce458b6b8e632ee3058a28986cfb61f63dd27fd34990ab6efb5
Opcode Fuzzy Hash: 3e8cb1c0501ad089ea6b6cc6f45962ba37e5e2d583b418bca81a1d4536d45afa
Instruction Fuzzy Hash: A9213271A00129AFDF00EFA4ED829BEB7F9EF48714F201015F501B7261DB709D059BA0

Function 00E4F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E4F3A3

Strings

`', xrefs: 00E4F375
8", xrefs: 00E4F44B

Memory Dump Source

Source File: 00000000.00000002.2201850154.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2201829502.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201850154.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201913361.0000000000E79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201930952.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201952792.0000000000E87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202064904.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202083616.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202106108.0000000000FFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202123118.0000000000FFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202143196.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202181548.0000000001010000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202200451.0000000001011000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202217449.0000000001012000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202233721.0000000001013000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202261988.000000000101C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202282374.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202300879.0000000001020000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202385444.0000000001023000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202435292.0000000001040000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202471173.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202504360.0000000001062000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202523208.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202540612.000000000106E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202558201.0000000001073000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202574747.0000000001074000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202593630.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202620576.0000000001087000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202647260.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202674668.0000000001096000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202697679.0000000001097000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202716393.0000000001098000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202743246.000000000109F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202765921.00000000010A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202794524.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202818762.00000000010A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202850400.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202917759.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202937034.0000000001115000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202955133.000000000111C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202970594.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202990177.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203006306.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'
API String ID: 3903695350-1436819768
Opcode ID: bc107a34c253060b43b5aa8b48b753531edf4934ea09561a059545d498b0dcec
Instruction ID: 6013dcb0dee6902358a682f9d3b96c63d848426e753e6da4ac3231e3e6826a7e
Opcode Fuzzy Hash: bc107a34c253060b43b5aa8b48b753531edf4934ea09561a059545d498b0dcec
Instruction Fuzzy Hash: 1E313932A00201DFEB21AE39E845B5B73E8EF4476EF14A439F459E7595DE70EC808A15

Analysis Process: skotes.exePID: 2676, Parent PID: 2260COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1967
Total number of Limit Nodes:	9

Executed Functions

Function 001C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,001C652A,?,?,?,?,?,001C7661), ref: 001C6567

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: af9aff894b3f1e22f23142c926649d4adda8df1b289cffefc3533459400685c0
Instruction ID: 9ff9521cce9877dce98a180e1d89b257d492b4792f07dfbb103443996fc93733
Opcode Fuzzy Hash: af9aff894b3f1e22f23142c926649d4adda8df1b289cffefc3533459400685c0
Instruction Fuzzy Hash: F5E08C30041148AFCE267B18C859F483B69EF3278AF205808FC1886222CB29ED82CA80

Function 00199BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cca52d316f804a7bde858fbf43e836dea516821628d8b97ec2f198870a86ad78
Instruction ID: fcb8839f7fb0a567a5c91088fe2710e9c58c31fcff781fad626ca95f8e9d935a
Opcode Fuzzy Hash: cca52d316f804a7bde858fbf43e836dea516821628d8b97ec2f198870a86ad78
Instruction Fuzzy Hash: 753148716042008BEF18EB7CDD89B6DBBA2EFC6314F20821CE115973D5CB759A858791

Function 00199F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 648d46735807c0d4fa697396ac8ccb3c4dcf720d899deb412acfc375eace00b3
Instruction ID: 803faaa60eba545dc25ed360b53253b4144629460957202f9559346312caff53
Opcode Fuzzy Hash: 648d46735807c0d4fa697396ac8ccb3c4dcf720d899deb412acfc375eace00b3
Instruction Fuzzy Hash: AB3148316041048BEF189B7CDC987ADFBA2EFC6314F24421CE519D73D5CB3599858792

Function 0019A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 129b5c96a78945ca2d72ce7d5a5def71ed4355ca3162fb8c5519bca024f29872
Instruction ID: beed17a8ccedd002ddc1eaeabe83e86ea9e25544897460547bb356639d3a8ff2
Opcode Fuzzy Hash: 129b5c96a78945ca2d72ce7d5a5def71ed4355ca3162fb8c5519bca024f29872
Instruction Fuzzy Hash: EB317931B142009BEF08DBB8DD88B6DBB72EFC2314F644218E014973D1CB3699888792

Function 0019A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0fcbb497f86ceacc424d7290a3381aea14a3ed154b44a22310b22e01490fd92a
Instruction ID: 00c22b4ac658f03f9208b43f4cd3eb5e010469db3c815e514e111f8b4bbfe966
Opcode Fuzzy Hash: 0fcbb497f86ceacc424d7290a3381aea14a3ed154b44a22310b22e01490fd92a
Instruction Fuzzy Hash: 26312631A041409FEF089BB8DC89B6DBB72EFD6314F604218E1149B3D1CB3699888692

Function 0019A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f8d02352c61f5ca6cef1af614bf299dfe1151a2121452292de1d98f8ce7d801f
Instruction ID: e9780e9977fcd75861bb908a3c58b56331599fd28f99217bc5602c4b7be665b0
Opcode Fuzzy Hash: f8d02352c61f5ca6cef1af614bf299dfe1151a2121452292de1d98f8ce7d801f
Instruction Fuzzy Hash: 48316831A001009BEF08ABB8DC89B7DBB72EFD2314F644218E0149B3D5CB7599888696

Function 0019A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b2e003ab86719ca07df5b971b371616e60ebc30f7af955bf451844e92766bab7
Instruction ID: a11181e8aeabb3cbdab34f86d9d6fd55a66d6ed1f093a3c62d3e9c288b157e16
Opcode Fuzzy Hash: b2e003ab86719ca07df5b971b371616e60ebc30f7af955bf451844e92766bab7
Instruction Fuzzy Hash: 4C3126717041008BFF08DBB8DC99B6DBBA2EFC6318F648218E1149B3D1CB3599898792

Function 0019A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 184145d9c6d1049bc775750ec9091142129b50af423b2f63ff10a3fdcb6a4e42
Instruction ID: 7848075dfab1178e635f1808ab6bfb1c910f5f21e8d7ef6b38fe04ca7545e527
Opcode Fuzzy Hash: 184145d9c6d1049bc775750ec9091142129b50af423b2f63ff10a3fdcb6a4e42
Instruction Fuzzy Hash: 9E3159716042409BEF0CDBBCDC89B6DBBB2EFC5314F648218E114973D1CB3599898792

Function 00199ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 10a1b2c293b77559acd0f8dbc09335cbfd4848bf8fb4c21cd898470b267fc814
Instruction ID: b0bf2bb0f059e80821cd6fe47843649523a49b37943dcf045fa847722c95a1d3
Opcode Fuzzy Hash: 10a1b2c293b77559acd0f8dbc09335cbfd4848bf8fb4c21cd898470b267fc814
Instruction Fuzzy Hash: 2D2146326042009BEF189B6CEC99B3CF762FFD1314F20421DE519977D1CB75A9858652

Function 0019A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a809308905cc4309f5c99c23083d6129a1a57987cf5824a6b8ee3d15d73b8fa9
Instruction ID: 4e98a8ca93730c54afcf978a5d1fc002d81ddaefef9abf7315a5062c3afaaeec
Opcode Fuzzy Hash: a809308905cc4309f5c99c23083d6129a1a57987cf5824a6b8ee3d15d73b8fa9
Instruction Fuzzy Hash: 11212C712582019AFF2877AC9C9AB3DB692EFD1305F740816E248D63D1CF76998981D3

Function 0019A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 98b5c36d2ef8dc3a5bef5dd29a79fe3d922a4fe6d0014dda6e8d528d240438e5
Instruction ID: 5907f75bd6618cfccc22c20f712e3fd38a5c52cfcdf21334e28a85d770a846e4
Opcode Fuzzy Hash: 98b5c36d2ef8dc3a5bef5dd29a79fe3d922a4fe6d0014dda6e8d528d240438e5
Instruction Fuzzy Hash: EF2149726042009BEF189B6CDC8977CBB72FFD1314F244219E519977D0CB76AA848292

Function 001CD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001CA813,00000001,00000364,00000006,000000FF,?,001CEE3F,?,00000004,00000000,?,?), ref: 001CD871

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: eefc215e3bd469519f14301f13eb671aed9b03edc3e0820c91ad2d797fe845ba
Instruction ID: 9b765cbbbffc6bda308bb56f27779096d9df66d9c74d9d7318f2b51aae52a156
Opcode Fuzzy Hash: eefc215e3bd469519f14301f13eb671aed9b03edc3e0820c91ad2d797fe845ba
Instruction Fuzzy Hash: DEF0E23260122466EF213A76BC01F6B7758DFB57B0B1B803DFD08A7181DB20DC1086E0

Non-executed Functions

Function 00192EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00192F5F
GetCurrentThreadId.KERNEL32 ref: 00192F7E
__Mtx_unlock.LIBCPMT ref: 00192FCC
__Cnd_broadcast.LIBCPMT ref: 00192FE3
__Mtx_unlock.LIBCPMT ref: 001930F5
GetCurrentThreadId.KERNEL32 ref: 00193132
__Mtx_unlock.LIBCPMT ref: 0019319B

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 79cdb060fe5af0c69c6e6f72bc84cb5e622e66696449fa9197f7db2c011fd3c0
Instruction ID: 02e5c3649cbe9d33939613d3a49ff9f09ce2317bf195cf18c417c5ba1fdaeb49
Opcode Fuzzy Hash: 79cdb060fe5af0c69c6e6f72bc84cb5e622e66696449fa9197f7db2c011fd3c0
Instruction Fuzzy Hash: C2A1C0B0A01605AFDF25DF64C944BAAB7F8FF25314F04812AE825D7251EB31EA04CBD1

Function 001CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001CCC66

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: f97d4599da598b88e2cdab96dd2d5b8ef1f15fa50ac17ed47a72b0be8718aa95
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: E5B101329042859FDB158F68C881BBEBFA5EF66340F1441AEE859EB241D734CD02CBE4

Function 001ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 001ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 001ABBE4
_xtime_get.LIBCPMT ref: 001ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 001ABC13

Memory Dump Source

Source File: 00000002.00000002.2242516422.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000002.00000002.2242486737.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242516422.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242609669.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242637537.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242671101.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242835994.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242871637.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242908704.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242935163.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2242962388.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243018799.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243046262.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243077277.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243105154.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243133975.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243161219.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243189240.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243219308.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243252155.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243280478.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243325386.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243354429.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243373277.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243401173.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243432005.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243462765.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243491435.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243519341.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243549368.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243576071.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243603762.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243632456.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243662761.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243690707.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243719271.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243748233.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243839467.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243873317.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243903313.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243933014.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243964053.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2243992754.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 138f0b5af1d33b6a5da6193fb7d3feb45c70012679f7c6d8d33cbb433b9c8bac
Instruction ID: dfa1fd3fc10346635a2c47c4979335f5947005efbd469372c3b449668fe3a41a
Opcode Fuzzy Hash: 138f0b5af1d33b6a5da6193fb7d3feb45c70012679f7c6d8d33cbb433b9c8bac
Instruction Fuzzy Hash: 90212C79A00119AFDF05EFA4DC819BEB7B9EF1A710F110025FA05AB261DB709D419BE0

Analysis Process: skotes.exePID: 4952, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	623
Total number of Limit Nodes:	4

Executed Functions

Function 001C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,001C652A,?,?,?,?,?,001C7661), ref: 001C6567

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 431cba13e600b01e3782c538305268af7dc8e8bb1c9b2d4ba9d247335ab0c01f
Instruction ID: a0436f36fdbf4f724eacb4fac89e7a4e81c97150aa7b833cc929c5b6571770aa
Opcode Fuzzy Hash: 431cba13e600b01e3782c538305268af7dc8e8bb1c9b2d4ba9d247335ab0c01f
Instruction Fuzzy Hash: 0BE08C3015114CAFCE26BB28C81DF483B69EF31785F201808FC1886222CB35ED81CA80

Function 00199BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 29379f2fd18ebac44112ec354dd1ed37518006eb1f3d8b6b4a384a6b4f11d6e9
Instruction ID: 788b8423eb478cc102426d2aa6f78752da3d70fbcc350a91faf17ff92530852a
Opcode Fuzzy Hash: 29379f2fd18ebac44112ec354dd1ed37518006eb1f3d8b6b4a384a6b4f11d6e9
Instruction Fuzzy Hash: 79312471B002008BEF18AB6CDD8DB6DB762EFC2320F20821CE4199B3D5C7759A848792

Function 00199F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7083f1e2bb38bc2000c5ac126b552d504f0daa85a8a206bb9cadfaa96ef5de68
Instruction ID: 43f55e7039fab84c0f50e3c0b20346fcb5ce9611d14cbefe85d16d88e27865e2
Opcode Fuzzy Hash: 7083f1e2bb38bc2000c5ac126b552d504f0daa85a8a206bb9cadfaa96ef5de68
Instruction Fuzzy Hash: 933146317002408BEF189B7CDC9DBADBB62EFC6320F644618E419EB7D1C73699848792

Function 0019A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b747612c34d540c1e81134a5f6aa222d5d170d2e8317fe64e31fb75e0461b423
Instruction ID: abdee4565aef2db8f907c8e6f44088d6b2f7c28f06ae2db6c8255a2fd43eadc3
Opcode Fuzzy Hash: b747612c34d540c1e81134a5f6aa222d5d170d2e8317fe64e31fb75e0461b423
Instruction Fuzzy Hash: B0314631B102409BEF089B78DD8DB6DB772EFC2324F644218E414977D1C73699888792

Function 0019A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 30be18557b96f5b8091f0db4c0dde0782d054b5c659eb13b3eb6020e1b0c6a8d
Instruction ID: c4920a6e6406129de54598665c47b747a0e7a874ded52311cd8c4e63035869f1
Opcode Fuzzy Hash: 30be18557b96f5b8091f0db4c0dde0782d054b5c659eb13b3eb6020e1b0c6a8d
Instruction Fuzzy Hash: 4D313731B002409BEF08DB78DD9DB6DB772EFD6320F644218E414AB7D1D73699888792

Function 0019A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c64757c652a2eeed451d01f47ea5bf7d2cd077759d92c435b82e8839632454cf
Instruction ID: 5b870060fdfe930108a1f8ca3e66dce7daec09c548ad755a71078f43d61301b2
Opcode Fuzzy Hash: c64757c652a2eeed451d01f47ea5bf7d2cd077759d92c435b82e8839632454cf
Instruction Fuzzy Hash: CE316631B002009BEF08ABB8DC8DB7DB772EFD2324F644218E4149B7D5DB7599888792

Function 0019A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5cc4335f77f98dab870970230237727f62d86539eb171856faf1decd9b9b056d
Instruction ID: 0fcf4dac4c63a2b61319c7a261c764942f5997daa8a7a886d8dd06d14b703abd
Opcode Fuzzy Hash: 5cc4335f77f98dab870970230237727f62d86539eb171856faf1decd9b9b056d
Instruction Fuzzy Hash: B5311431B002409BEF08DB78DC9DB6DB762EFD6324F648618E415AB7D1CB3599888792

Function 0019A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0845fa537d52ed4ce4837d9f678cd3f0e8b3b3356baa6a9e1f3253e7d2f19e35
Instruction ID: 0442be84e849f26ea66005def6d3a434745cc410c1fbb3a00b4e80759be1423c
Opcode Fuzzy Hash: 0845fa537d52ed4ce4837d9f678cd3f0e8b3b3356baa6a9e1f3253e7d2f19e35
Instruction Fuzzy Hash: 3A312431B002409BEF0C9BB8DC8DB6DB7B2EFC2324F648218E414977D1C73699888692

Function 00199ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6542d5570dc460168edc802ef454e865e083af3085d13651deb455bdb8f2de8f
Instruction ID: 3afe07338d838a7c7974b33b091625efb753eeb8e327c65c708d9c62ebafc098
Opcode Fuzzy Hash: 6542d5570dc460168edc802ef454e865e083af3085d13651deb455bdb8f2de8f
Instruction Fuzzy Hash: AD2134327042409BEF189B6CEC9DB2CB762EFD1320F20421DE819977D1DB7599848692

Function 0019A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4b0a588c14366f9e765d049ea45e3a6ecffcfa912b5d55c0bbd05dcc6e4516da
Instruction ID: f9ddbe3f5507b8f35764a64448e49430fdbe7db5ed0a92e97ecdd2c09c5dd2a1
Opcode Fuzzy Hash: 4b0a588c14366f9e765d049ea45e3a6ecffcfa912b5d55c0bbd05dcc6e4516da
Instruction Fuzzy Hash: CD2149313592019AEF2877A89C9EB3DB352EF91305FB40816E508D63D1CB7A998882D3

Function 0019A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0019A963
CreateMutexA.KERNELBASE(00000000,00000000,001F3254), ref: 0019A981

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e49eba967b9617262ad63327213e20298e0889e580b493c45b7b8a43872b4ace
Instruction ID: 0d677183c136465ad3869a355da65b80a86f938a11d7ef5e17a5a294d9f4f0f3
Opcode Fuzzy Hash: e49eba967b9617262ad63327213e20298e0889e580b493c45b7b8a43872b4ace
Instruction Fuzzy Hash: 3B214C317042009BEF189B68DC8DB7CB762EFD1314F644219E819977D0C7769A848292

Non-executed Functions

Function 00192EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00192F5F
__Mtx_unlock.LIBCPMT ref: 00192FCC
__Cnd_broadcast.LIBCPMT ref: 00192FE3
__Mtx_unlock.LIBCPMT ref: 001930F5
__Mtx_unlock.LIBCPMT ref: 0019319B

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 79cdb060fe5af0c69c6e6f72bc84cb5e622e66696449fa9197f7db2c011fd3c0
Instruction ID: 02e5c3649cbe9d33939613d3a49ff9f09ce2317bf195cf18c417c5ba1fdaeb49
Opcode Fuzzy Hash: 79cdb060fe5af0c69c6e6f72bc84cb5e622e66696449fa9197f7db2c011fd3c0
Instruction Fuzzy Hash: C2A1C0B0A01605AFDF25DF64C944BAAB7F8FF25314F04812AE825D7251EB31EA04CBD1

Function 001CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001CCC66

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: f97d4599da598b88e2cdab96dd2d5b8ef1f15fa50ac17ed47a72b0be8718aa95
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: E5B101329042859FDB158F68C881BBEBFA5EF66340F1441AEE859EB241D734CD02CBE4

Function 001ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 001ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 001ABBE4
_xtime_get.LIBCPMT ref: 001ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 001ABC13

Memory Dump Source

Source File: 00000003.00000002.2240662532.0000000000191000.00000040.00000001.01000000.00000007.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2240620691.0000000000190000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240662532.00000000001F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240765715.00000000001F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240792903.00000000001FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240821768.0000000000207000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2240998336.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241035647.0000000000365000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241079835.000000000037C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241116847.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.000000000037F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241135078.0000000000387000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241172636.0000000000390000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241192646.0000000000391000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241212245.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241232061.0000000000393000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241252698.000000000039C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241272046.000000000039F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241291687.00000000003A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241311473.00000000003A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241336990.00000000003C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241358615.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241385005.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241406457.00000000003ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241425985.00000000003EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241446155.00000000003F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241465232.00000000003F4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241489713.00000000003F8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241516809.0000000000407000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241544798.000000000040B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241565960.0000000000416000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241588643.0000000000417000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241613880.0000000000418000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241647466.000000000041F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241674026.0000000000420000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241701812.0000000000425000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241757817.0000000000426000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.000000000042A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241785471.0000000000466000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241883956.0000000000494000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241912745.0000000000495000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241947499.000000000049C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2241977267.000000000049E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242022100.00000000004AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2242088472.00000000004AD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 204d84a308b6672854333c050d6817991dae2893660e77e075a3dbfcec51032f
Instruction ID: dfa1fd3fc10346635a2c47c4979335f5947005efbd469372c3b449668fe3a41a
Opcode Fuzzy Hash: 204d84a308b6672854333c050d6817991dae2893660e77e075a3dbfcec51032f
Instruction Fuzzy Hash: 90212C79A00119AFDF05EFA4DC819BEB7B9EF1A710F110025FA05AB261DB709D419BE0

Analysis Process: a2236cc5aa.exePID: 7084, Parent PID: 4396COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	0.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 00DD519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00DD5110,00DD5100), ref: 00DD5334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00DD5347
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 00DD5365
ReadProcessMemory.KERNELBASE(00000088,?,00DD5154,00000004,00000000), ref: 00DD5389
VirtualAllocEx.KERNELBASE(00000088,?,?,00003000,00000040), ref: 00DD53B4
WriteProcessMemory.KERNELBASE(00000088,00000000,?,?,00000000,?), ref: 00DD540C
WriteProcessMemory.KERNELBASE(00000088,00400000,?,?,00000000,?,00000028), ref: 00DD5457
WriteProcessMemory.KERNELBASE(00000088,?,?,00000004,00000000), ref: 00DD5495
Wow64SetThreadContext.KERNEL32(0000008C,003F0000), ref: 00DD54D1
ResumeThread.KERNELBASE(0000008C), ref: 00DD54E0

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00DD5333
SetThreadContext, xrefs: 00DD52C2
VirtualAlloc, xrefs: 00DD5263
CreateProcessW, xrefs: 00DD5250
VirtualAllocEx, xrefs: 00DD529C
Load, xrefs: 00DD51DA
GetP, xrefs: 00DD521E
WriteProcessMemory, xrefs: 00DD52AF
TerminateProcess, xrefs: 00DD53C3
GetThreadContext, xrefs: 00DD5276
ReadProcessMemory, xrefs: 00DD5289
ress, xrefs: 00DD5226
aryA, xrefs: 00DD51E2
ResumeThread, xrefs: 00DD52D8

Memory Dump Source

Source File: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 989f8274f969cee446b61acf6b97c31d75e6792b0fdf7342065cb2899501485a
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: F3B1087260064AAFDB60CF68CC80BDA77A5FF88714F158125EA0CAB345D774FA51CBA4

Function 00DB1614 Relevance: 9.2, APIs: 6, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB1098: _strlen.LIBCMT ref: 00DB10F9

CreateFileA.KERNELBASE ref: 00DB1675
GetFileSize.KERNEL32(00000000,00000000), ref: 00DB1685
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00DB16AB
CloseHandle.KERNELBASE(00000000), ref: 00DB16BA
_strlen.LIBCMT ref: 00DB1705
CloseHandle.KERNEL32(00000000), ref: 00DB1805

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: ecd77fdec98e806e79b2d5a23cf12da153b46498937b30fc16d4efbb0cc497db
Instruction ID: 25ee9cabc4909cd4d7462a28ecc503710f4588eebcf6730eec83f7f8a11fa02c
Opcode Fuzzy Hash: ecd77fdec98e806e79b2d5a23cf12da153b46498937b30fc16d4efbb0cc497db
Instruction Fuzzy Hash: B951D0B9904341EBC700AF24DC94BAAB7E5FF88314F55492DF48A97351EB34D9448B72

Function 00DB123B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00DB12C7

Strings

[+], xrefs: 00DB12E1
Fu, xrefs: 00DB12C7

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: [+]$Fu
API String ID: 6842923-1661062833
Opcode ID: 63d5d7766d456f74efc0ed4d31695b54ed26ffe97f06354c315fadfe967f7afc
Instruction ID: 3155e51bb10628b413caf91abaad1bb3dbc6a9f5246e3d022a10b759eff89bf0
Opcode Fuzzy Hash: 63d5d7766d456f74efc0ed4d31695b54ed26ffe97f06354c315fadfe967f7afc
Instruction Fuzzy Hash: 3E31F73550D3808FD726AB3868997EBBBD4ABAD318F18097DD8CA87343D1615445CB72

Function 00DB155C Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB1098: _strlen.LIBCMT ref: 00DB10F9

FreeConsole.KERNELBASE ref: 00DB158B

Part of subcall function 00DB123B: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00DB12C7

VirtualProtect.KERNELBASE(00DD5011,00000549,00000040,?), ref: 00DB15D7
ExitProcess.KERNEL32 ref: 00DB160E

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ConsoleDispatcherExceptionExitFreeProcessProtectUserVirtual_strlen
String ID:
API String ID: 2898289550-0
Opcode ID: c3956d0c0d22169b104495fc41331b2ebbe5f9df250afdae606e43a05677e355
Instruction ID: a42f1d1b7395e8f56a8ee6db7e38b5e9eb21c72d6b496c8e108e778e709ff21a
Opcode Fuzzy Hash: c3956d0c0d22169b104495fc41331b2ebbe5f9df250afdae606e43a05677e355
Instruction Fuzzy Hash: 0C119471A01209ABEB00ABA5EC52FFF7768EB84700F504026F609E7385E67599154AF5

Function 00DC5283 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DC562D: GetConsoleOutputCP.KERNEL32(BD993700,00000000,00000000,?), ref: 00DC5690

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00DBBBF3,?), ref: 00DC5408
GetLastError.KERNEL32(?,?,00DBBBF3,?,00DBBE37,00000000,?,00000000,00DBBE37,?,?,?,00DD4628,0000002C,00DBBD23,?), ref: 00DC5412

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 8baceb3d7d2d00a82c2f91a3eb1c5e03974911289375b17ca624f2429d510e71
Instruction ID: 2dec4949b190fdff822976449f2c34ba8244e507484fb5790c0ae46c2d926830
Opcode Fuzzy Hash: 8baceb3d7d2d00a82c2f91a3eb1c5e03974911289375b17ca624f2429d510e71
Instruction Fuzzy Hash: 5661A371D0464AAFDF158FA8E844FAEBBB9EF59304F18015DE800A7219D771E985CB70

Function 00DC5A5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00DC53EE,00000000,00DBBE37,?,00000000,?,00000000), ref: 00DC5AF8
GetLastError.KERNEL32(?,00DC53EE,00000000,00DBBE37,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00DBBBF3), ref: 00DC5B1E

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: a55872772f84e0544c3ff17202ffa7c442c99ef9cc2f673c7ca0a25134ffdc44
Instruction ID: 21c364b0c1455108b6090143bb8190e3ae5c6983b1eee64c04289c49c911cb5b
Opcode Fuzzy Hash: a55872772f84e0544c3ff17202ffa7c442c99ef9cc2f673c7ca0a25134ffdc44
Instruction Fuzzy Hash: EC217331A0161A9BCF15CF29ED80AE9B7F9EB48301F1441ADE906D7215D630EE828B71

Function 00DBFF89 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00DBFE78,00DD4948), ref: 00DBFFD5
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00DBFE78,00DD4948), ref: 00DBFFE7

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 084b8d4df701efcd547b4bac1844b6f40159468312f0036c1b96adf897746859
Instruction ID: 8c56633d8929d8eb9f0fc1ba8184ae05deb26fcf7e285c75fe0dc00a6ade88dd
Opcode Fuzzy Hash: 084b8d4df701efcd547b4bac1844b6f40159468312f0036c1b96adf897746859
Instruction Fuzzy Hash: 6D119061504752CACB314B3E9C88B22AE95AB56334B39076ED1B7C76F1C220D94AE661

Function 00DB136E Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00DB1388

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 1cb237f3d7314e7b96f666be92bdbf94c6fcfdcc6d43510c1f2f5519903a0b0c
Instruction ID: 379cd5076086b35bed8086860b57f1585a3a6a3b880d53867d52ae9ac75506ce
Opcode Fuzzy Hash: 1cb237f3d7314e7b96f666be92bdbf94c6fcfdcc6d43510c1f2f5519903a0b0c
Instruction Fuzzy Hash: 0751B3353042048FCB14DF6DC994BAA77D2EF88724F59866CE96ACB392D630ED05CB51

Function 00DB3C29 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d72757c92f56f0b9b35fbe6eba995933e106e11896f144e4702ec0962b02eb
Instruction ID: 123fd7a80e906e523fda0d0ce734257f17d237dbe9790152c1df0e073bde7a66
Opcode Fuzzy Hash: d7d72757c92f56f0b9b35fbe6eba995933e106e11896f144e4702ec0962b02eb
Instruction Fuzzy Hash: 9431537290011AEFCB15CFA8D8909EDBBF9BF09320B14426AE512E7690D721EA44DB70

Function 00DB3C1B Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: fec4bb194830cd689b46542882853077a7af26bdabcbd5335f8023a737dc79f7
Instruction ID: 924a6e2be7b9716e9ab0ab6464c54aee3fe4f7224773eee76eeace3312ff76ac
Opcode Fuzzy Hash: fec4bb194830cd689b46542882853077a7af26bdabcbd5335f8023a737dc79f7
Instruction Fuzzy Hash: 1C012636A08216DBCB158BB8E9653E8BF60FF85334F24415FD003994D0CB225514E270

Function 00DBE531 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00DB31E1,00DB186A,?,00DB60C1,00DB186C,00DB186A,?,?,?,00DB3181,00DB31E1,00DB186E,00DB186A,00DB186A,00DB186A), ref: 00DBE563

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a6853fcae5ac9fbd5bd1b5432b49db405971efac4021539f5f71bbf858d59ea
Instruction ID: e508e04338c73679d1e2c698f013e37175f89a6955838c6e5b1d61620704242e
Opcode Fuzzy Hash: 2a6853fcae5ac9fbd5bd1b5432b49db405971efac4021539f5f71bbf858d59ea
Instruction Fuzzy Hash: F0E0E531901220DADA306B69AC00BDE37CCDF017B4F180112AC4797191FB60CD0095F1

Non-executed Functions

Function 00DC3178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00DC2B49,00000002,00000000,?,?,?,00DC2B49,?,00000000), ref: 00DC3211
GetLocaleInfoW.KERNEL32(?,20001004,00DC2B49,00000002,00000000,?,?,?,00DC2B49,?,00000000), ref: 00DC323A
GetACP.KERNEL32(?,?,00DC2B49,?,00000000), ref: 00DC324F

Strings

ACP, xrefs: 00DC3196
OCP, xrefs: 00DC31CC

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8dbbbb3b2e038ed1d8f17d11c5b820f0e22715732dd243bc7b09294c22c66485
Instruction ID: 3a53d547c55bc8fc7dd16cda30af1ef7fecc70945c4173328e40739b792996e2
Opcode Fuzzy Hash: 8dbbbb3b2e038ed1d8f17d11c5b820f0e22715732dd243bc7b09294c22c66485
Instruction Fuzzy Hash: A7219D32600202AADF358F94D805FA7B3A6EB54B64B6EC42DE90AD7210E732DF41D774

Function 00DC2A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00DC2B1B
IsValidCodePage.KERNEL32(00000000), ref: 00DC2B59
IsValidLocale.KERNEL32(?,00000001), ref: 00DC2B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00DC2BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00DC2BCF

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c4a488c60f179e49d33dfc581452bd326c9478c9e4bb4d27f67c2659547cb94e
Instruction ID: 583216830c71cdf071b0cf2be81785a463e6a3377424a06b301a484805067c3c
Opcode Fuzzy Hash: c4a488c60f179e49d33dfc581452bd326c9478c9e4bb4d27f67c2659547cb94e
Instruction Fuzzy Hash: 78515B71A00217ABDB21DFA4CC81FBA77B9EF14700F18406DA511E7190EBB09E059B71

Function 00DC375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC384A

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0aec8e12db7ba79095a85bbe9ed6f52a16a8db2399c820baaed11f6e188589e2
Instruction ID: 368a4cc7949c9a3789d97f5852ef1c4f541841ab55423dc898e09ba88f72c36a
Opcode Fuzzy Hash: 0aec8e12db7ba79095a85bbe9ed6f52a16a8db2399c820baaed11f6e188589e2
Instruction Fuzzy Hash: 4571B4B190515AAFDF209F288C9DFEAB7B9EB05300F1881DEE04993251DA318F858F70

Function 00DB5020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00DB502C
IsDebuggerPresent.KERNEL32 ref: 00DB50F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DB5111
UnhandledExceptionFilter.KERNEL32(?), ref: 00DB511B

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 986fd9c09493c3855a18c955700eff43c373ed137c0663473ec351f6992fe0db
Instruction ID: 0b3af012090c47a897cf368c084169c414fcf0d0813006ad5130efd49969daa5
Opcode Fuzzy Hash: 986fd9c09493c3855a18c955700eff43c373ed137c0663473ec351f6992fe0db
Instruction Fuzzy Hash: C131F975D05328DBDB20EF64D949BCDBBB8AF08300F1041AAE40DAB250EB719B858F55

Function 00DC2CFF Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DC2D53
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DC2D9D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DC2E63

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 32c8dd00613d40a51070ac0e14e38c502369bac2b52e75fc668603cd0ec92e08
Instruction ID: fa4d3258d833c2689e8e887bde834da71252d398e1d83c438b2452d592174e26
Opcode Fuzzy Hash: 32c8dd00613d40a51070ac0e14e38c502369bac2b52e75fc668603cd0ec92e08
Instruction Fuzzy Hash: D9616E71911207DBDB289F29CC82FBAB7A8EF14311F1441AEE905D7285EB74DA81DB70

Function 00DBB4B9 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00DB31E1), ref: 00DBB5B1
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00DB31E1), ref: 00DBB5BB
UnhandledExceptionFilter.KERNEL32(00DB1542,?,?,?,?,?,00DB31E1), ref: 00DBB5C8

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3826d0eb2d5990eb5cf7fb96ba9a5b367b43adcc5f96b67fabae3cf42dd05205
Instruction ID: 79a46b26cae0b0478f326e7416e26904915ef28d8bf0f64233229fa1a26e1016
Opcode Fuzzy Hash: 3826d0eb2d5990eb5cf7fb96ba9a5b367b43adcc5f96b67fabae3cf42dd05205
Instruction Fuzzy Hash: A031B374901228EBCB21DF28DD897DCBBB8BF48310F5041EAE41DA7251EB709B858F65

Function 00DC36A9 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DBF807: HeapAlloc.KERNEL32(00000008,?,00DB31E1,?,00DBE921,00000001,00000364,00DB31E1,00000003,000000FF,?,00DB60C1,00DB186C,00DB186A,?,?), ref: 00DBF848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC384A
FindNextFileW.KERNEL32(00000000,?), ref: 00DC393E
FindClose.KERNEL32(00000000), ref: 00DC397D
FindClose.KERNEL32(00000000), ref: 00DC39B0

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 44af67e3d8aed02a46c55d62d97b1fcb3a62741dd04dc71502828b9928ffa0a2
Instruction ID: 757671fe492514a1cc85d585e139513c6dea1af22e11e0152fb7eab83d6fb502
Opcode Fuzzy Hash: 44af67e3d8aed02a46c55d62d97b1fcb3a62741dd04dc71502828b9928ffa0a2
Instruction Fuzzy Hash: F65158B590011AAFDF149F689C89FFEB7A9DF85314F28819EF44993241EA309E419B70

Function 00DC2FB1 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DC3005

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 52a08c3a4f760abc765ae0d6af6650784807de5a106f9b9314af3698afb645b6
Instruction ID: 6d4215f57c8b13578bc7f4263f28d398a770e949715e88c220acc5f024ace2b2
Opcode Fuzzy Hash: 52a08c3a4f760abc765ae0d6af6650784807de5a106f9b9314af3698afb645b6
Instruction Fuzzy Hash: 3821AF72601207ABDF289E69DC42FBA73A8EB04301B14806EFD02C7145EB34DE009A70

Function 00DC30D1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DC3125

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5a52e772106af88d66f246d349c0b580858fdba66dfcea37adcdeac0551d8e9e
Instruction ID: 5922781f50a9ced975e0d112632909d43390c068b5062980831414f136192453
Opcode Fuzzy Hash: 5a52e772106af88d66f246d349c0b580858fdba66dfcea37adcdeac0551d8e9e
Instruction Fuzzy Hash: B011A032611317ABDB24AB28DC42EBAB7A8EF05311B14416EF506D7240EB74EE009BB0

Function 00DC2C64 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

EnumSystemLocalesW.KERNEL32(00DC2CFF,00000001,00000000,?,-00000050,?,00DC2AEF,00000000,-00000002,00000000,?,00000055,?), ref: 00DC2CD6

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b153968a36d65c008213afb4c6cdfbd889c476611f84f4844399d1a033daaca6
Instruction ID: 09a1a13a987d906e5f729cb300eb67c23f0941b3af2fbe5365f578c4373644c9
Opcode Fuzzy Hash: b153968a36d65c008213afb4c6cdfbd889c476611f84f4844399d1a033daaca6
Instruction Fuzzy Hash: 5511E93B2007065FDB18AF39C991BBABB92FF80759B18442DE94787B40D771A943DB60

Function 00DC327E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00DC2F1B,00000000,00000000,?), ref: 00DC32AA

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b7eb78c836b2cbacb4ae6a4e547e577ed30601892c77e22130a6858a9347d156
Instruction ID: e1f1ddb454c119b584961613c194c6e1f64342e39ea157286557a9174a901777
Opcode Fuzzy Hash: b7eb78c836b2cbacb4ae6a4e547e577ed30601892c77e22130a6858a9347d156
Instruction Fuzzy Hash: 7601D632600113BBDF285A25C806FBABB54DB40755F19852DEC52A3180EA71EF41CBB8

Function 00DC2F52 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

EnumSystemLocalesW.KERNEL32(00DC2FB1,00000001,?,?,-00000050,?,00DC2AB7,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00DC2F9C

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: df956689705fe333d7c7c292e90ec30e1b2118dea73eff116aa0c3a4c21f1087
Instruction ID: 5dd3c7ec35b4aa07a2438424208f563f71cabc7cd2fd3c9b46e4e56ba03d5fc0
Opcode Fuzzy Hash: df956689705fe333d7c7c292e90ec30e1b2118dea73eff116aa0c3a4c21f1087
Instruction Fuzzy Hash: 5CF0F6362003095FDB146F3A9C95F7A7BA1EF80768B19842DF9458B680C7B19C42CA70

Function 00DBF717 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBB750: EnterCriticalSection.KERNEL32(-00023A67,?,00DB8F5A,00000000,00DD44D8,0000000C,00DB8F13,?,?,00DBF83A,?,?,00DBE921,00000001,00000364,00DB31E1), ref: 00DBB75F

EnumSystemLocalesW.KERNEL32(00DBF70A,00000001,00DD4928,0000000C,00DBF118,-00000050), ref: 00DBF74F

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 365f886cb43f344eba8e9398402576c0cfe783fc1a7408a4c418f84749cf1135
Instruction ID: 2af95ad0a93a4acd4b8c809261d010d2296437de3914abd8f3c75d86810ca700
Opcode Fuzzy Hash: 365f886cb43f344eba8e9398402576c0cfe783fc1a7408a4c418f84749cf1135
Instruction Fuzzy Hash: 2EF0E776A05704EFD700DFA9E842B9D77B0EB48762F10416AE416DB3A0CBB99905CFA0

Function 00DC3086 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

EnumSystemLocalesW.KERNEL32(00DC30D1,00000001,?,?,?,00DC2B11,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00DC30BD

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 936c01cb522340189f4d24516d428b4fe3ca5a3ab3fbc8e1c748c0e77973f5f9
Instruction ID: 78b03afcd45ab8b61c77ee617852d9b35268d0a8ac179af3c52224b5d87e2a43
Opcode Fuzzy Hash: 936c01cb522340189f4d24516d428b4fe3ca5a3ab3fbc8e1c748c0e77973f5f9
Instruction Fuzzy Hash: BDF0EC3670030657CB04AF39D855B667F94EFC1711B0A405DEA058B251C6719942D7B0

Function 00DBF21C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00DBA4BC,?,20001004,00000000,00000002,?,?,00DB93CE), ref: 00DBF250

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7fcc9515a24d33bd73e9d6e7f2f75af8f4701076d439462de35a021810f8e0a0
Instruction ID: 36db403253d2df53f7cdd576005d0e87feda1304ecf8802d8c6dea727bb2e0e2
Opcode Fuzzy Hash: 7fcc9515a24d33bd73e9d6e7f2f75af8f4701076d439462de35a021810f8e0a0
Instruction Fuzzy Hash: E1E04F36501218FBCF222F60DC05AEE3F15EF44760F044421FD06A5261CB718920AAB9

Function 00DB5014 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005135), ref: 00DB5019

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ac3221a49e2176852ba79738a240d79b8958799344018d4025381894d6f3247
Instruction ID: 3dea38e0ca3255b4c9732f3bc02175bc52dbb6d5eff9c86145a304602bf3bb6d
Opcode Fuzzy Hash: 2ac3221a49e2176852ba79738a240d79b8958799344018d4025381894d6f3247
Instruction Fuzzy Hash:

Function 00DBFE2C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00DBFE2C

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ba4b88ba86a1941daa119402a46b5808a2a226e7b9a311a7b5267382d8afe77c
Instruction ID: 2dd21af22eb7a2c67c9d654b63634ea48d4947409aa38bee6de0df41c4897f01
Opcode Fuzzy Hash: ba4b88ba86a1941daa119402a46b5808a2a226e7b9a311a7b5267382d8afe77c
Instruction Fuzzy Hash: 1CA01130A033008B83008F3AAE08A083BAAAA00280308802AA000C0220EB20C080AF22

Function 00DCA222 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00A8FEE0,00A8FEE0,00000000,7FFFFFFF,?,00DCA20D,00A8FEE0,00A8FEE0,00000000,00A8FEE0,?,?,?,?,00A8FEE0,00000000), ref: 00DCA2C8
__alloca_probe_16.LIBCMT ref: 00DCA383
__alloca_probe_16.LIBCMT ref: 00DCA412
__freea.LIBCMT ref: 00DCA45D
__freea.LIBCMT ref: 00DCA463
__freea.LIBCMT ref: 00DCA499
__freea.LIBCMT ref: 00DCA49F
__freea.LIBCMT ref: 00DCA4AF

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: a7b08a989aa7b72b372c67fb8b5f9e40a30f2282be5e03833895724026de1af7
Instruction ID: 2702fdaddf21470b5cd64612498b0d51a92b832d91f1550bf6a6323950c30c0e
Opcode Fuzzy Hash: a7b08a989aa7b72b372c67fb8b5f9e40a30f2282be5e03833895724026de1af7
Instruction Fuzzy Hash: 6971D23290425FABDF259FA88C55FEE7BBADF45318F28401DE909A7281E675CC008772

Function 00DB54C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00DB550C
__alloca_probe_16.LIBCMT ref: 00DB5538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00DB5577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DB5594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00DB55D3
__alloca_probe_16.LIBCMT ref: 00DB55F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00DB5632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00DB5655

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b05f55bf56390e70d67925f369fb801d38f100505c73025f8ccb0ac3fb6b1594
Instruction ID: 53bc125930b35d2e6b20b20960f8eea10a4e4e1f685283a2743802d49d8659a5
Opcode Fuzzy Hash: b05f55bf56390e70d67925f369fb801d38f100505c73025f8ccb0ac3fb6b1594
Instruction Fuzzy Hash: 25518E72600606EFEF209F64EC45FEA7BA9EB44750F594426FD06D6198DB70CD108BB0

Function 00DB61E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DB6217
___except_validate_context_record.LIBVCRUNTIME ref: 00DB621F
_ValidateLocalCookies.LIBCMT ref: 00DB62A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00DB62D3
_ValidateLocalCookies.LIBCMT ref: 00DB6328

Strings

csm, xrefs: 00DB62BD

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 87c7164c5d1b05d4c1bf9f2febdf259c4b2597de00af8a2288ab74316d960937
Instruction ID: 01d1ff3be05c3cad0d0fca85a248a3388838cf69f0d47de4da0076aabe1b9e50
Opcode Fuzzy Hash: 87c7164c5d1b05d4c1bf9f2febdf259c4b2597de00af8a2288ab74316d960937
Instruction Fuzzy Hash: EA41A030A00219EFDF10DF68C881AEE7BA5EF45324F188155F8169B352D735DA05CBB5

Function 00DBF469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00DBF578,00DB186A,?,00000000,00DB31E1,00DB186C,?,00DBF1F6,00000022,FlsSetValue,00DCDFE0,00DCDFE8,00DB31E1), ref: 00DBF52A

Strings

ext-ms-, xrefs: 00DBF4D4
api-ms-, xrefs: 00DBF4C0

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4d7faa5ae2ff5547fd971c46e616715a6998d9862fd84df5da69f84ebbbde0f0
Instruction ID: 5e5b1c3d525b152b7a37069703d7ad484f7fe839dbac06edfb21bfb1ea8b9309
Opcode Fuzzy Hash: 4d7faa5ae2ff5547fd971c46e616715a6998d9862fd84df5da69f84ebbbde0f0
Instruction Fuzzy Hash: 63219376A02312EBC7319B64EC44A9A77A8DB41764B284135FD47E7391E730EE00C6F1

Function 00DC625D Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c8e76a1657df7ec108c05692b6d94a1c0a0a6d010f979de42fe3ef8b90ecde
Instruction ID: f0619c6ad654b2982fa03db7b6a4e76e319a096c05f90d3b5f3d93a233dbe50e
Opcode Fuzzy Hash: a2c8e76a1657df7ec108c05692b6d94a1c0a0a6d010f979de42fe3ef8b90ecde
Instruction Fuzzy Hash: 30B111B0A08246AFDB11DFA8D850FAEBBB5EF49310F28415DE5019B386C770D946CBB1

Function 00DBD2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DBD2B7,00DB5FB7,00DB5179), ref: 00DBD2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DBD2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DBD2F5
SetLastError.KERNEL32(00000000,00DBD2B7,00DB5FB7,00DB5179), ref: 00DBD347

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 88b5306a686e2b53296bb4f0937267ce398710d2ce9bcc4e48ac0fd569840ac0
Instruction ID: 040d8a042733be1bdebc56bc0f9d1234156786c3d1c0aa9b9796269353b86400
Opcode Fuzzy Hash: 88b5306a686e2b53296bb4f0937267ce398710d2ce9bcc4e48ac0fd569840ac0
Instruction Fuzzy Hash: B401D83220F716DE962517747CD5EAA37C9EB02775728022EF112953E5FF618C046BB1

Function 00DBDB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DBDCA7
CallUnexpected.LIBVCRUNTIME ref: 00DBDF20

Strings

csm, xrefs: 00DBDC32
csm, xrefs: 00DBDCDE
csm, xrefs: 00DBDBC5

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: f4ba1dd64ec9a209875a4f24c227421f423d6987623be55cc338c719dd9cd275
Instruction ID: 74d6a2a225f176445695d2787d4a44c8215adf06a696fb497b6d8f66ce17ca2a
Opcode Fuzzy Hash: f4ba1dd64ec9a209875a4f24c227421f423d6987623be55cc338c719dd9cd275
Instruction Fuzzy Hash: 9FB13C71800209EFCF15DFA4C8819EEBBB6FF18310B184559F8526B215E771EA51CBB5

Function 00DB8C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BD993700,?,?,00000000,00DCB774,000000FF,?,00DB8D16,00DB8BFD,?,00DB8DB2,00000000), ref: 00DB8C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DB8C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DCB774,000000FF,?,00DB8D16,00DB8BFD,?,00DB8DB2,00000000), ref: 00DB8CBE

Strings

CorExitProcess, xrefs: 00DB8C94
mscoree.dll, xrefs: 00DB8C83

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 315142995d6316912097376be83fbe8d13f75b9719acffaadfd2b3569305c785
Instruction ID: 226677a807c95918b71b8f9a5e37b046de03fa3ae53e02d43d7dc0aade804a70
Opcode Fuzzy Hash: 315142995d6316912097376be83fbe8d13f75b9719acffaadfd2b3569305c785
Instruction Fuzzy Hash: 15012C71946B59EFDB118B54DC09BAEBBB8FB44B11F044526E812E23D0DBB49904CEA0

Function 00DBFC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00DBFCC2
__alloca_probe_16.LIBCMT ref: 00DBFD8B
__freea.LIBCMT ref: 00DBFDF2

Part of subcall function 00DBE531: RtlAllocateHeap.NTDLL(00000000,00DB31E1,00DB186A,?,00DB60C1,00DB186C,00DB186A,?,?,?,00DB3181,00DB31E1,00DB186E,00DB186A,00DB186A,00DB186A), ref: 00DBE563

__freea.LIBCMT ref: 00DBFE05
__freea.LIBCMT ref: 00DBFE12

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 233ef32cdbcc86db93e4c0993efd7a003d911810891e271aaf6586bfbd9d7acb
Instruction ID: dfe2408a7adde3a736985f14b827765958af881559c63ad293cfbeff4a73635d
Opcode Fuzzy Hash: 233ef32cdbcc86db93e4c0993efd7a003d911810891e271aaf6586bfbd9d7acb
Instruction Fuzzy Hash: 19518072600246EBDF219F619C82EFB7BA9EF44710B190539FD06DB152EB30DD5096B0

Function 00DB3010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DB3017
std::_Lockit::_Lockit.LIBCPMT ref: 00DB3022
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB3090

Part of subcall function 00DB2EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00DB2EFC

std::locale::_Setgloballocale.LIBCPMT ref: 00DB303D
_Yarn.LIBCPMT ref: 00DB3053

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 3403a47c11147325a04df8b2f3ee38cd6c1a79e5421ae4375ee69971b8c3a127
Instruction ID: 270ca573725258a96e2b9d2e0034c8d5e56ac08c558ac973ae8f3f8e3b043066
Opcode Fuzzy Hash: 3403a47c11147325a04df8b2f3ee38cd6c1a79e5421ae4375ee69971b8c3a127
Instruction Fuzzy Hash: 96015AB6A01611DBCB06EF60E855ABD7B61FF84750B14400AE81297381CB34AA42DBF1

Function 00DC7E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DC7F2E,00000000,?,00DD6E10,?,?,?,00DC7E65,00000004,InitializeCriticalSectionEx,00DCE57C,00DCE584), ref: 00DC7E9F
GetLastError.KERNEL32(?,00DC7F2E,00000000,?,00DD6E10,?,?,?,00DC7E65,00000004,InitializeCriticalSectionEx,00DCE57C,00DCE584,00000000,?,00DBE1DC), ref: 00DC7EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DC7ED1

Strings

api-ms-, xrefs: 00DC7EB6

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 506f8431ebf2c1b6e905a18d71e1e0f77a22125babd1659d6d9ad58ccb63d314
Instruction ID: cedd07736645fadd743a856beb1e0acead7ba086e10bcb204f7d1781c5686397
Opcode Fuzzy Hash: 506f8431ebf2c1b6e905a18d71e1e0f77a22125babd1659d6d9ad58ccb63d314
Instruction Fuzzy Hash: 88E09A3128430ABAEA201BA0EC06F193F58DB20B50F140021F90DF86E1E7B1DA508AA6

Function 00DC562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BD993700,00000000,00000000,?), ref: 00DC5690

Part of subcall function 00DBE641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00DBFDE8,?,00000000,-00000008), ref: 00DBE6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DC58E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DC5928
GetLastError.KERNEL32 ref: 00DC59CB

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5c262551f44609393a800d4c717a56923223982a0f9dd76612a3b46ded187fcb
Instruction ID: 97bb0eb8f6ddcb0e0cd7badf87ece334c6cb730601272e22346c2d1951378c03
Opcode Fuzzy Hash: 5c262551f44609393a800d4c717a56923223982a0f9dd76612a3b46ded187fcb
Instruction Fuzzy Hash: CED17A75D00649DFCF15CFA8E880AADBBB5EF08310F28456EE456EB355D630A986CF60

Function 00DBD8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DBD976
___AdjustPointer.LIBCMT ref: 00DBD999
___AdjustPointer.LIBCMT ref: 00DBDA35

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c79bf6d2f9a1eed4b46fdef0f0d15c09bcf10e8273394751e52720433a8ca3a7
Instruction ID: c8fc42468b5e8d3c67ec831657eae75e3c368fdfca81110c4c9f4668ace36595
Opcode Fuzzy Hash: c79bf6d2f9a1eed4b46fdef0f0d15c09bcf10e8273394751e52720433a8ca3a7
Instruction Fuzzy Hash: 3851AC72A05602EFDF299F15D841BEAB7A6EF45710F184429E8479B291FB31ED40CBB0

Function 00DC3537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00DBE641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00DBFDE8,?,00000000,-00000008), ref: 00DBE6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00DC359B
__dosmaperr.LIBCMT ref: 00DC35A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00DC35DC
__dosmaperr.LIBCMT ref: 00DC35E3

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 348de34f05c34419e829e3b82b2138e991856d6608398293155daa221600af20
Instruction ID: 9230aaa9dfb7468ece60f0271061948adda32a0514681d1b6fe48ad728d71bda
Opcode Fuzzy Hash: 348de34f05c34419e829e3b82b2138e991856d6608398293155daa221600af20
Instruction Fuzzy Hash: 0521D771610606AFDB20AF699841E6AB7ACFF44364704C52DF86687641EB30EF008BB1

Function 00DB8042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1414b4045904472ab093ab6bbfb897d816675d06a29a17e2e5e6447da326b15d
Instruction ID: 796ea0688103129d41cd39462e6b050139d6ed96a75ee61add84f3cf9911f1ca
Opcode Fuzzy Hash: 1414b4045904472ab093ab6bbfb897d816675d06a29a17e2e5e6447da326b15d
Instruction Fuzzy Hash: 89219D31604205EFDB20AF68CC909EA77ADEF543A4B144529F86B97251EF31EC00EBB1

Function 00DC484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DC4857

Part of subcall function 00DBE641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00DBFDE8,?,00000000,-00000008), ref: 00DBE6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DC488F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DC48AF

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: b14bdc7e4a782367876f2b70c8373d081c3bdac4e0682d3b19c99dc4e12a809c
Instruction ID: f8b568063745b0e38d5596d80c860c2fff1517aa807109d2e414c28ebf4ad488
Opcode Fuzzy Hash: b14bdc7e4a782367876f2b70c8373d081c3bdac4e0682d3b19c99dc4e12a809c
Instruction Fuzzy Hash: 4C1166F9903266BFA71527B59CAEDFF6F6CCE857943140528F802D3200FA64CE0082B1

Function 00DB457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DB4582
std::_Lockit::_Lockit.LIBCPMT ref: 00DB458C

Part of subcall function 00DB24C2: std::_Lockit::_Lockit.LIBCPMT ref: 00DB24DE
Part of subcall function 00DB24C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00DB24F7

codecvt.LIBCPMT ref: 00DB45C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB45FD

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: f9fe2269f06c4e96975c0e8575540cbf53a118ebd9b461014d1f3da40a662a0f
Instruction ID: 1f4b87fb1a0038c5200950648ad86f55faaeff0721356a67c99fe8a21807d460
Opcode Fuzzy Hash: f9fe2269f06c4e96975c0e8575540cbf53a118ebd9b461014d1f3da40a662a0f
Instruction Fuzzy Hash: A801A936900619DBCB04EBA4D826AFD77A1FF94320F24054AE413AB392CF70DE018BB1

Function 00DCA4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DC9B0F,00000000,00000001,00000000,?,?,00DC5A1F,?,00000000,00000000), ref: 00DCA4F7
GetLastError.KERNEL32(?,00DC9B0F,00000000,00000001,00000000,?,?,00DC5A1F,?,00000000,00000000,?,?,?,00DC5365,00000000), ref: 00DCA503

Part of subcall function 00DCA554: CloseHandle.KERNEL32(FFFFFFFE,00DCA513,?,00DC9B0F,00000000,00000001,00000000,?,?,00DC5A1F,?,00000000,00000000,?,?), ref: 00DCA564

___initconout.LIBCMT ref: 00DCA513

Part of subcall function 00DCA535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DCA4D1,00DC9AFC,?,?,00DC5A1F,?,00000000,00000000,?), ref: 00DCA548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DC9B0F,00000000,00000001,00000000,?,?,00DC5A1F,?,00000000,00000000,?), ref: 00DCA528

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 44d86bc833f6928ea7e986eb3af4ce2d28f4f3dcc482f0e5139613e1127244b0
Instruction ID: cf6dedad4a5cd3adcfab529c0edfb490b5acd9c3e284efb1f3191f34e1f2210b
Opcode Fuzzy Hash: 44d86bc833f6928ea7e986eb3af4ce2d28f4f3dcc482f0e5139613e1127244b0
Instruction Fuzzy Hash: 81F03736122319BFCF221F95EC04E9A3F26FF44364B044515F909C6230D631C9209BB2

Function 00DB59A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00DB59B9
GetCurrentThreadId.KERNEL32 ref: 00DB59C8
GetCurrentProcessId.KERNEL32 ref: 00DB59D1
QueryPerformanceCounter.KERNEL32(?), ref: 00DB59DE

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 74f40213ef1d26cf39a0236d795e9feeb03aeab37d790e0e631b7524cf58cdd7
Instruction ID: 349a99a602cf619bc2026d93613ac4e6026d566fa9cb53f1a0bcbcbf2dd93328
Opcode Fuzzy Hash: 74f40213ef1d26cf39a0236d795e9feeb03aeab37d790e0e631b7524cf58cdd7
Instruction Fuzzy Hash: 90F06274D1220DEBCB00DBB4D94999EFBF4FF1C204B915596A412E7210E770AB449F61

Function 00DC2117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBE783: GetLastError.KERNEL32(00000000,?,00DC0AB9), ref: 00DBE787
Part of subcall function 00DBE783: SetLastError.KERNEL32(00000000,?,?,00000028,00DBB9D2), ref: 00DBE829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00DB9266,?,?,?,00000055,?,-00000050,?,?,?), ref: 00DC21D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00DB9266,?,?,?,00000055,?,-00000050,?,?), ref: 00DC220D

Strings

utf8, xrefs: 00DC22DF

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 3013b64f7212d4c10110ecb44c6483212b4b72adeae2173b969a77adbe0c72d3
Instruction ID: 5077f7478f932c9b81ca8702e037d40fd5d9a849684ca163d63d98584d172475
Opcode Fuzzy Hash: 3013b64f7212d4c10110ecb44c6483212b4b72adeae2173b969a77adbe0c72d3
Instruction Fuzzy Hash: 2051E571A40357EADB25AB75CC82FB6B3A8EF45700F18042EFA45DB181FA74E940C6B5

Function 00DBDFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00DBDEAD,?,?,00000000,00000000,00000000,?), ref: 00DBDFD1

Strings

RCC, xrefs: 00DBDFEB
MOC, xrefs: 00DBDFE3

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6119cb03903e24ce6bbd163f87ba6a94e0661ae43c1a6e6185677199f135091d
Instruction ID: d9b4a9358b358f8a5f51b2143e81a2d51e249440897425ff47ac478882f3814d
Opcode Fuzzy Hash: 6119cb03903e24ce6bbd163f87ba6a94e0661ae43c1a6e6185677199f135091d
Instruction Fuzzy Hash: FD416831900209EFCF26EF98DC81AEEBBB5FF48300F188059FA06A7255D3B59950DB61

Function 00DBD818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DBDA8F

Strings

csm, xrefs: 00DBDB22
csm, xrefs: 00DBDAB1

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 7d7c782a2f1ae1a36aac978d86e2b1db7cdd8b50c8d324e865eca47e1176c4f1
Instruction ID: d38c5c3873791a4b7b293efe187dc435d37d0bdf34a37d97a0df87976c699793
Opcode Fuzzy Hash: 7d7c782a2f1ae1a36aac978d86e2b1db7cdd8b50c8d324e865eca47e1176c4f1
Instruction Fuzzy Hash: 4431CF32500209EBCF269F54C8409EA7B77FF08365B2D416AF8564A221E333CCA1DBB5

Function 00DB29D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00DD648C,ios_base::badbit set,?,?,00DB1C84,00DD6478,00DB1B17), ref: 00DB29DF
ReleaseSRWLockExclusive.KERNEL32(00DD648C,?,?,00DB1C84,00DD6478,00DB1B17), ref: 00DB2A19

Strings

ios_base::badbit set, xrefs: 00DB29D8

Memory Dump Source

Source File: 00000007.00000002.2763958749.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.2763873546.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764012563.0000000000DCC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764043735.0000000000DD5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764114148.0000000000DD6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764142311.0000000000DD8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764235243.0000000000DDA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2764318279.0000000000DDD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_a2236cc5aa.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: f9abc8c8285188522abee05a63e74a949a0a1cf6ddff96f5e72f8bf37684a69a
Instruction ID: 4d454915616ec9a6521eab33db1e9a928617df9ca52d371a1279cf1f4255ac03
Opcode Fuzzy Hash: f9abc8c8285188522abee05a63e74a949a0a1cf6ddff96f5e72f8bf37684a69a
Instruction Fuzzy Hash: 3DF08236501200DBCB24AF18D844AB5BB68FB45735F14032FE89B833A0C7316842CE71

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFIJJEG

C:\ProgramData\E3E3OPZUA1N7\26XT0Z

C:\ProgramData\E3E3OPZUA1N7\58GD2V

C:\ProgramData\E3E3OPZUA1N7\9Z5X4W47G

C:\ProgramData\E3E3OPZUA1N7\AIMOHV

C:\ProgramData\E3E3OPZUA1N7\F3OHLN

C:\ProgramData\E3E3OPZUA1N7\OHL68YCT0

C:\ProgramData\E3E3OPZUA1N7\SJECBA

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre